Eight ways to stop bots without making your visitors prove anything — including the free ones, our competitors, and honest guidance on when you do not need a product at all.
We sell one of the options on this list. So here is the deal: every entry below gets a straight description, we recommend competitors where they genuinely fit, and the SpamKill pitch is confined to one clearly-labelled block near the end. If that section is all you read, you can skip it — the rest of the page is useful without it.
Feature lists are a poor way to compare these, because they change every quarter. Three architectural questions do not, and they predict almost everything you will care about later.
The third one. Blocked spam gets counted; lost enquiries do not. A filter that quietly rejects real customers looks identical to a filter that works perfectly — right up until someone tells you they tried to reach you three times.
| Alternative | Approach | Visitor sees | What it inspects |
|---|---|---|---|
| Honeypot field Free, and worth adding regardless of what else you do. |
Hidden field a human never fills | Nothing | One property of the submission |
| Timing + rate limiting Free. Stops volume attacks that nothing else does as cheaply. |
Server-side heuristics | Nothing | Submission timing and frequency |
| Cloudflare Turnstile The best of the challenge widgets if you want one. |
Challenge widget, usually silent | Rarely a challenge | The session, before submission |
| hCaptcha More private than reCAPTCHA; still shows puzzles. |
Challenge widget | Puzzles | The session, before submission |
| Friendly Captcha No puzzle to solve; positions on accessibility and EU privacy. |
Proof-of-work in the browser | A brief wait | Client compute, before submission |
| Akismet Comment-first heritage. Spam reaches you, then gets sorted. |
Content filtering after submission | Nothing | The message text, after it arrives |
| CleanTalk Large shared spam database; strong WordPress presence. |
Cloud reputation database | Nothing | Sender reputation and content |
| SpamKill Ours. See the labelled section below for the honest pitch. |
Behavioural scoring after capture | Nothing | How the form was filled in |
Pricing is deliberately absent — it changes faster than this page will. Check each vendor's current terms.
Genuinely: try these before you buy anything, including from us. For a lot of sites they are the whole answer, and they cost nothing but an afternoon.
A field a human never sees and never fills. If it comes back populated, the submitter was automated. Free, invisible, and it removes the bottom tier of spam traffic immediately.
Its ceiling is real though: commercial form-filling tools read computed styles and
skip fields that are hidden or suspiciously named. Never use
type="hidden" — bots ignore it by default — and hide it from assistive
technology with aria-hidden="true" and tabindex="-1", or
screen reader users will fill it in and be silently rejected. Full detail in
honeypot vs CAPTCHA.
Record when the form rendered, reject implausibly fast submissions, and cap submissions per IP and per target address. Sign the timestamp — a plain hidden field with the render time is trivially rewritten by the client.
Rate limiting in particular does something nothing else on this list does as cheaply: it stops the volume attacks that fill an inbox overnight, and it is the only real defence against your signup form being used to bomb someone else's address. See email list bombing.
If you have decided you want a challenge widget, this is the one. It shows a puzzle far less often than reCAPTCHA, it is free for standard use, it does not require you to be a Cloudflare customer, and it is not funded by advertising signal.
We compare it against ourselves at Turnstile alternative, and against reCAPTCHA even-handedly at Turnstile vs reCAPTCHA — where our conclusion is that you should pick Turnstile over Google's product.
Positioned as the privacy-respecting alternative to reCAPTCHA, and on privacy the claim holds up. But it still shows puzzles, so the conversion and accessibility cost is the one you were trying to escape. Sensible if privacy is the whole reason you are switching and you accept the friction. (Our comparison.)
A different mechanism: instead of a puzzle, the visitor's browser does a small amount of computation before the form submits. Nothing to solve, which makes the accessibility story much better than a visual challenge, at the cost of a brief wait and some client CPU. A reasonable option, and they rank well for this query because their content is good.
Checks submissions against a large shared spam corpus after they arrive. Strong comment-spam heritage and easy to deploy on WordPress. The structural trade-off is that spam reaches your database and gets sorted there rather than being stopped at the door, and you review a spam queue. (Our comparison.)
A cloud reputation database — sender history and content checked against a large shared dataset. Well established in the WordPress ecosystem. Worth knowing that reputation approaches struggle with a fresh IP and a plausible message, which is exactly what commercial form-fillers use.
An API for spam scoring, aimed at developers who want to build the integration themselves. Good fit if you have engineering time and want control; poor fit if you wanted something that works this afternoon. (Our comparison.)
The category that judges how a form was filled in rather than testing the visitor or reading the message. Humans move a pointer, shift focus between fields, type irregularly, correct themselves, and take seconds to minutes. Scripts populate fields in DOM order in milliseconds with no interaction events at all.
There are many signals rather than one rule, which is the structural advantage: a bot has to defeat all of them simultaneously, and the signals update as automation changes. It is also invisible — there is nothing for a visitor to pass or fail.
SpamKill is this category as a hosted service. It renders two versions of every form — clean for people, obfuscated for automated fillers — and scores the submission on behaviour, at 99.9% accuracy across more than 100M+ submissions screened for 1,500+ businesses. No challenge, nothing for a visitor to fail, and every held submission is reviewable rather than silently discarded — which is the third question above, and the one most of this list answers badly. From $29/month with a 30-day free trial, no credit card.
If the free options in section three already solved your problem, you do not need us, and we would tell you that on a call.
| If you… | Choose |
|---|---|
| Run a small site with modest traffic | Honeypot + timing check + rate limiting. Stop there. |
| Want a drop-in widget and accept some friction | Cloudflare Turnstile |
| Are switching away from Google specifically for privacy | Turnstile, or hCaptcha if you need its feature set |
| Have an accessibility obligation to meet | Anything with no challenge — the free options, or behavioural detection |
| Are on WordPress and want comment spam handled too | Akismet or CleanTalk |
| Have engineering time and want full control | OOPSpam's API, or build on the free options |
| Keep getting convincing fake leads that pass everything | Behavioural detection — that is the category built for it |
| Are being hit by human form-fillers | None of the above. Content filtering and manual review. |
Running two form-level gates on the same form gives you the friction of the stricter one and the accuracy of neither, because each sees only part of the picture and real people still get stopped by the weaker. Network-level bot management at your CDN is a different layer and composes fine with any choice above.
There is no single answer, and be sceptical of any page that gives you one. If you want a challenge widget, Cloudflare Turnstile is the strongest of them. If you want no challenge at all, behaviour-based detection is the category to look at. If your traffic is modest, a honeypot plus a server-side timing check plus rate limiting may be all you ever need, and those cost nothing.
Several. A honeypot field, a signed timing check and rate limiting are free, you control them entirely, and together they remove most opportunistic spam. Cloudflare Turnstile is free for standard use and does not require you to be a Cloudflare customer. Free stops being enough when you are facing commercial form-filling tools rather than crude scripts.
Three reasons that hold regardless of vendor. It taxes every real visitor to inconvenience a minority of bots. It is a documented accessibility barrier — the W3C states that every type of CAPTCHA is unsolvable by users with some disabilities. And it decides before the form is filled in, so it never examines the submission that actually arrives.
Not two form-level gates on the same form. You get the friction of the stricter one and the accuracy of neither, because each sees only part of the picture and real users still get stopped by the weaker. Network-level bot management at your CDN operates at a different layer and composes fine with any form-level choice.
No, and any vendor claiming otherwise is overselling. Paid form-fillers in click farms are real people doing the task by hand, so behavioural signals correctly identify them as human. That problem needs content filtering, rate limits and manual review — not bot detection.
Anything with no user-facing challenge, because there is nothing for a visitor to fail. That includes honeypots (hidden correctly, with aria-hidden and tabindex="-1"), server-side heuristics and behavioural detection. Among challenge widgets, the one that challenges least often is the most accessible, which currently means Turnstile.
Paste your real form HTML into the Form Transformer and get the protected version back. No signup, no card, nothing to install.
Open the Form Transformer