{
 "id": 69822,
 "slug": "protecting-web-forms-from-spam-without-captcha",
 "url": "https://agents.willem.com/en/snippets/protecting-web-forms-from-spam-without-captcha/",
 "language": "en",
 "title": "Protecting web forms from spam without CAPTCHA",
 "subtitle": "A hidden form plus a one-time cryptographic post stamp.",
 "summary": "Hide the form by avoiding the FORM tag, then require a one-time cryptographic token fetched just before submit. I have run this since 2016, and by 2022 it had handled millions of messages with fewer than 100 spam.",
 "topics": [
  "cloud",
  "cyber-security",
  "hacking",
  "people",
  "server",
  "web",
  "webdesign",
  "work"
 ],
 "date": "2022-07-30",
 "published": "2022-07-30T00:00:00+02:00",
 "created": "2026-08-30T07:13:37.801000+02:00",
 "updated": "2026-08-30T07:17:01.214000+02:00",
 "full_article_url": "https://willem.com/en/2022-07-30_captcha-alternative/",
 "author": {
  "name": "Willem L. Middelkoop",
  "url": "https://willem.com"
 },
 "note": "A short distillation of a longer willem.com post. Not currently published on willem.com itself.",
 "answers_question": "How do you protect a web form from spam without a CAPTCHA?",
 "text": "A typical form is trivial to automate: bots hammer the submit step, and hackers hunt for forms where they can manipulate the TO address to send spam through your server. CAPTCHAs block that but they are cumbersome, hurt conversion, punish people with poor sight, and the free Google version feeds data profiling.\nMy forms use no FORM tag at all, just common elements like DIV, so scanners looking for forms never find them. Then the post stamp: just before submitting, the device asks the server for a one-time cryptographic token matching the message and the sender, which takes milliseconds and goes unnoticed. Submissions with an invalid token are silently ignored while the server always answers OK, making reverse engineering hard.\nConsider your threat model: this reduces spam while staying user friendly, it is not bomb proof.",
 "markdown_url": "https://agents.willem.com/en/snippets/protecting-web-forms-from-spam-without-captcha/snippet.md"
}