Contact form without reCAPTCHA — spam protection without Google scripts
🎧 Listen to every article back to back
A contact form can be protected from spam without reCAPTCHA or Google scripts. Honeypot fields, timing checks, IP limits and content filtering can stop much of the automated traffic without tracking the user.
Why replace reCAPTCHA
reCAPTCHA v3 is effective, but its convenience comes with privacy, compliance and third-party dependency questions.
Privacy. reCAPTCHA loads scripts from Google and sends browser and interaction signals to a third party. Organisations that minimise external data sharing need to assess and document that processing.
GDPR. The appropriate legal basis and any consent requirement depend on the implementation, the data processed and the organisation's circumstances. A reCAPTCHA deployment therefore needs a privacy assessment rather than a blanket assumption that it is automatically compliant.
Load time. reCAPTCHA adds external scripts and network requests to the page. The exact effect depends on the version, configuration and browser cache.
The alternative does not have to be complex. Bots behave differently from humans. Catching that difference requires only a few simple checks. The same approach fits a simple PHP form and a Drupal site where privacy, performance and form reliability are part of technical maintenance.
How the protection works
Every form submission passes through several layers in sequence. The earlier a bot is caught, the better — later checks are more expensive.
Layer 1: Honeypot
A hidden field is added to the form — one that a human never sees or fills in. Many basic bots fill every field they find, including this one. A value in the hidden field is therefore a strong signal of automated submission.
One important detail: the rejected sender does not get an error. The server responds with success, so the response does not reveal which check was triggered.
Layer 2: Timing check
A human opens a form, reads it, thinks and types, which takes time. Basic bots often submit within a fraction of a second of loading the page.
When the page loads, the time is recorded. On the server, we check whether at least three seconds passed before submission. A submission under three seconds is treated as likely automated; one after two hours is treated as stale or replayed. Both get a silent success response rather than an error.
Layer 3: IP rate limiting
Even if a bot passes the previous layers, the current form accepts at most 20 submissions from one IP address per hour. Further attempts get a clear error message so a legitimate user knows why the submission was rejected.
Layer 4: Email domain checks
Two checks run in this layer. First, known disposable address services such as Mailinator, Guerrilla Mail and YopMail are checked against a blocklist. Second, a DNS lookup checks whether the domain can receive email. An address on a domain with no mail route is unlikely to be usable.
Layer 5: Stop Forum Spam
Stop Forum Spam (opens in a new tab) is a public database of known spammer IP addresses and email addresses. Each submission can be checked against its API. Only high-confidence matches are blocked — a lower threshold would mean too many false positives.
If the API does not respond (network error, timeout), the submission is allowed through. When in doubt, reliability comes first.
Layer 6: Content filter
Many bots send messages with characteristic content — casino, viagra, SEO services, backlinks, crypto. A score-based filter adds points for suspicious keywords. One keyword does not block; a combination does. This reduces false positives compared to hard-coded blocking.
Alternatives
A local solution is not the only option. Here are the main alternatives and their trade-offs.
Cloudflare Turnstile (opens in a new tab) is a privacy-focused alternative that usually requires less user interaction than a traditional CAPTCHA. It still introduces a third-party service, so its data processing and legal basis should be documented for the specific implementation.
hCaptcha (opens in a new tab) is another popular reCAPTCHA alternative — more privacy-conscious, paid for higher volumes. It occasionally asks users to solve image recognition challenges, which some find annoying.
Akismet (opens in a new tab) is a spam-filtering service from Automattic, the company behind WordPress. It integrates readily with WordPress forms; licensing and data processing should be reviewed for the intended use.
Math CAPTCHAs ("What is 3+4?") can stop simple bots but require user interaction and are easily automated. They are a poor fit when accessibility and low friction matter.
Cloudflare WAF (opens in a new tab) or a similar web application firewall becomes relevant when the traffic volume is high. Available rules and controls depend on the chosen service and plan, but this layer can also address threats beyond form spam.
The local layered solution works best for small to medium traffic sites where you want more control over data flows and fewer external dependencies.
What this solution does not do
Distributed attacks. If a thousand different IP addresses each send one message, the rate limiter only stops repeat offenders. At that volume, Cloudflare WAF or similar is a better fit.
Highly sophisticated bots. This works well against typical bot traffic. If someone targets your form specifically and adapts their bot accordingly, some will get through. Against that kind of adversary, automated filtering is not the right tool — human review is more useful.
The result
A contact form with no reCAPTCHA or Google scripts and a clearer view of where submission data is processed.
Protection layers in order: origin check → honeypot → timing → email validation → IP rate limiting → Stop Forum Spam → content filter.
Each layer contributes a separate signal. Together they reduce routine spam without claiming to stop every targeted submission. Get in touch if you want the same approach for your own form.
Need Drupal help?
If the article describes your situation, you do not have to read everything first. A real person will help you choose the next step.