Is the honeypot enough on its own?

For most contact forms, yes. It silently catches the large majority of automated spam with zero friction for real visitors. Add a captcha if a form is being targeted.

Does spam count against my plan quota?

No. Submissions caught as spam are stored in a separate tab and never metered or emailed.

Will captcha annoy my visitors?

Turnstile and hCaptcha are largely invisible or single-click. You choose the provider and level per form.

Can I review what got flagged?

Yes. The dashboard has a Spam tab where you can read flagged submissions and mark false positives as not-spam.

How much spam does the honeypot actually block?

For typical contact forms it catches the large majority of automated spam on its own, because most bots blindly fill every field. Forms under active, targeted attack benefit from adding a captcha on top.

Does spam protection work on localhost / in development?

Yes. The honeypot, captcha verification and rate limits all run server-side on our end, so it behaves the same in local development as in production. There's no client-only step that silently no-ops off your live domain.

Spam protection

Form spam protection, stopped at the door.

Form spam protection is the set of checks FormWire runs on every submission before it reaches you. A server-side honeypot is on by default. Layer on the provider you trust when you need more.

Get your access key → See the honeypot code

FormWire <[email protected]>

to you · just now

Delivered

New submission: Contact form

Name Ada Lovelace

Email [email protected]

Message Hi! Love the site. Do you take on freelance projects this quarter?

Reply-To: [email protected] · hit reply, land with your visitor

Supported methods

Bring the provider you already trust.

The honeypot and rate limiting protect every form automatically. Captchas and domain rules are per-form toggles in the dashboard, no code changes beyond the widget's own snippet.

Honeypot

On by default.

hCaptcha

Free, privacy-first.

reCAPTCHA

v2 & v3.

Turnstile

Invisible, no puzzles.

Rate limits

Per key & per IP.

Domain rules

Allowlist your sites.

How it works

How form spam protection works.

Cheapest checks first, so bots are rejected before they cost you anything and real submissions pass through untouched.

Honeypot first

A hidden field bots fill and humans never see. Filled means filtered: stored as spam, never emailed, never counted against your quota.
Captcha when configured

If you've enabled a provider, its token is verified server-side before the submission is accepted.
Rate & domain rules

Per-key and per-IP throttles plus optional domain restriction cap abuse from non-browser clients.

FormWire <[email protected]>

to you · just now

Delivered

New submission: Contact form

Name Ada Lovelace

Email [email protected]

Message Hi! Love the site. Do you take on freelance projects this quarter?

Reply-To: [email protected] · hit reply, land with your visitor

The honeypot

One hidden field, zero friction.

The default protection is a hidden field bots fill and humans never see. Add it once. FormWire checks it server-side on every submission, so it works everywhere, including localhost.

<form action="https://api.formwire.io/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR-ACCESS-KEY">

  <!-- Honeypot: hidden from humans, irresistible to bots -->
  <input type="checkbox" name="fax_number" tabindex="-1"
         autocomplete="off" style="display:none">

  <input name="email" type="email" required>
  <textarea name="message" required></textarea>
  <button type="submit">Send</button>
</form>

<form onSubmit={onSubmit}>
  <input type="hidden" name="access_key" value="YOUR-ACCESS-KEY" />

  {/* Honeypot: hidden field bots fill, humans don't */}
  <input
    type="checkbox"
    name="fax_number"
    tabIndex={-1}
    autoComplete="off"
    style={{ display: "none" }}
  />

  <input name="email" type="email" required />
  <textarea name="message" required />
  <button>Send</button>
</form>

Keep the field visually hidden and out of the tab order. Real users never touch it; bots that fill it are filed as spam.

Which method should I use?

Pick a spam method by friction and threat.

Start with the honeypot. It's on by default and free. Add a second layer only when a form is actively targeted.

Method	User friction	Best for	Setup
Honeypot	None (invisible)	Every form, the default first line	On by default
Cloudflare Turnstile	Near-zero (invisible)	Targeted forms, privacy-conscious sites	Toggle + widget
hCaptcha	Low (often single-click)	Targeted forms, free tier	Toggle + widget
reCAPTCHA	Low–medium	Teams already in Google's ecosystem	Toggle + widget
Rate limits + domain rules	None	Capping abuse from non-browser clients	Rate limits built in; domain rules per form

You can combine methods. Every check runs server-side, so protection behaves the same in development and production.

Spam protection FAQ

Want the full feature list?

All features

Keep reading.

All features

Everything a form needs, nothing to run.

Integrations

Route clean submissions to Slack, Sheets & webhooks.

Documentation

Add spam-safe forms to any stack.

Pricing

Free to start, fair when you grow.

Ready in a minute

Keep the spam out of your inbox.

Get your access key →

Honeypot included on every plan, free tier included.