Honeypot vs CAPTCHA: which to use on your forms

Start with a honeypot: a hidden field that real visitors never see, that needs no third party, and that the W3C's report on CAPTCHA accessibility recommends whenever it's enough. Add a CAPTCHA only when bots keep getting past it. Then pick one that rarely shows a puzzle (Cloudflare Turnstile, Friendly Captcha, hCaptcha or reCAPTCHA v3) and always check its token on your server. A CAPTCHA stops more bots, but it costs some visitors access and sends data to a third party, so it should earn its place on the form.

Key takeaways

• A honeypot stops the bots that fill every field and costs real visitors nothing. It misses bots that skip hidden fields and anyone posting straight to your server without filling it.
• A CAPTCHA stops more automated traffic, but only if your server verifies each token; the widget alone protects nothing.
• The W3C's note on CAPTCHA (December 2021) finds visual and audio puzzles exclude many disabled people. WCAG 2.2 requires alternatives in different senses if you use one.
• CAPTCHA scripts read signals from the visitor's device, which brings in the ePrivacy rules in the EU, PECR in the UK and Article 45c of the Telecommunications Act in Switzerland. A honeypot doesn't.
• Cloudflare Turnstile is free with unlimited challenges; reCAPTCHA is free up to 10,000 assessments a month per organization; hCaptcha and Friendly Captcha have free tiers with limits (all checked October 2026).

Honeypot vs CAPTCHA at a glance

How a honeypot works

You add a field that people can't see or reach. A bot that fills in every field fills that one too, and your server drops the lead while answering exactly as if it worked, so the bot learns nothing.

<form action="/contact" method="post">
  <label>Email <input name="email" type="email" required></label>
  <label>Message <textarea name="message"></textarea></label>

  <!-- Honeypot: off-screen, out of the tab order, skipped by screen readers -->
  <div aria-hidden="true" style="position:absolute;left:-9999px">
    <label>Leave this empty <input name="website" tabindex="-1" autocomplete="off"></label>
  </div>

  <button type="submit">Send</button>
</form>

// A standard Request handler (Cloudflare Workers, Next.js route handlers, SvelteKit, Deno, Bun)
export async function POST(request) {
  const form = await request.formData();
  const thanks = new URL('/thanks', request.url);

  // Honeypot filled: answer exactly like a success, but keep nothing.
  if (form.get('website')) {
    return Response.redirect(thanks, 303);
  }

  // ...store or forward the lead here...
  return Response.redirect(thanks, 303);
}

• Hide it from people, not just from eyes. tabindex="-1" keeps keyboard users out, aria-hidden="true" keeps screen readers out, and the "Leave this empty" label tells anyone who still lands on it what to do.
• Don't call it email or name. Browsers autofill fields with those names, and a real visitor's autofill would trip the trap.
• Check it on the server. A check in the browser alone is skipped by any script that posts to your endpoint directly.

How a CAPTCHA works

A script from the provider runs on your page, decides whether the visitor looks human (sometimes asking them to tick a box or solve a puzzle) and puts a token in the form. Your server sends that token to the provider and only accepts the lead if it comes back valid. With Cloudflare Turnstile, the widget adds a field called cf-turnstile-response, and Cloudflare says plainly that you must call its Siteverify API: the widget alone doesn't protect your form (Turnstile docs, checked October 2026).

<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

<form action="/contact" method="post">
  <!-- your fields and the honeypot, as above -->
  <div class="cf-turnstile" data-sitekey="your-site-key"></div>
  <button type="submit">Send</button>
</form>

// Call this in the handler above, after the honeypot check and before storing the lead.
async function passedTurnstile(form, request, secret) {
  const body = new FormData();
  body.append('secret', secret); // from your environment, never from the page
  body.append('response', String(form.get('cf-turnstile-response') ?? ''));
  const ip = request.headers.get('cf-connecting-ip');
  if (ip) body.append('remoteip', ip);

  const res = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
    method: 'POST',
    body,
  });
  const outcome = await res.json();
  return outcome.success === true; // tokens last 300 seconds and work once
}

A token works once, for 300 seconds. reCAPTCHA, hCaptcha and Friendly Captcha follow the same pattern: script, token, server check.

Accessibility: what the W3C says

The W3C's Inaccessibility of CAPTCHA (a Group Draft Note from December 2021, checked October 2026) is the reference here. It finds that distorted-text and image CAPTCHAs block screen reader users and many people with low vision, dyslexia or cognitive disabilities, and that audio alternatives add their own barriers. In its words, such CAPTCHAs "fail to properly recognize users with disabilities as human". It welcomes invisible, score-based checks, notes they push hard cases back onto site owners, and lists honeypots among the easy alternatives, to use until there's evidence you need more.

WCAG 2.2 doesn't ban CAPTCHAs, but it sets conditions. Success criterion 1.1.1 requires a text alternative that describes the CAPTCHA's purpose and alternative forms that use different senses (Understanding 1.1.1). On login forms, criterion 3.3.8 (level AA) requires a way through that isn't a cognitive test, with object recognition as an exception at AA (Understanding 3.3.8). Vendors make their own claims: Cloudflare says Turnstile is WCAG 2.2 AA compliant, and Friendly Captcha says it is fully accessible with no image tasks. Test them with a keyboard and a screen reader on your own form.

Privacy: EU, UK, Switzerland and US

A honeypot is part of your own form, so it adds no new processing. A CAPTCHA adds a third-party script that reads signals from the visitor's device, and the rules for that differ by place. This page is not legal advice.

• EU. Article 5(3) of the ePrivacy Directive covers storing or reading information on a visitor's device. The EDPB's Guidelines 2/2023 (version 2.0, adopted 7 October 2024) say JavaScript that makes the browser send information falls within it. Whether a CAPTCHA is "strictly necessary" and needs no consent is left to national law and each country's authority, case by case. Where personal data such as an IP address is processed, the GDPR also needs a lawful basis (Article 6) and information for visitors (Article 13). Google says that since April 2, 2026 it acts as a data processor for reCAPTCHA, which makes you the controller, and that its _GRECAPTCHA cookie is a necessary cookie (reCAPTCHA FAQ).
• UK. Regulation 6 of PECR sets the same storage and access rule. The ICO lists preventing or detecting fraud, and keeping the visitor's device secure, among examples that may be strictly necessary, but only if the information is used solely for that purpose (ICO guidance). The UK GDPR still applies to the personal data itself.
• Switzerland. Article 45c of the Telecommunications Act allows processing data on users' devices if they're told about it and its purpose and told they may refuse. The Federal Act on Data Protection covers the personal data.
• US. There's no federal rule like ePrivacy. If the CCPA applies to your business, Civil Code 1798.100 requires telling visitors, at or before collection, what categories of personal information you collect and why. Other state laws have their own thresholds.

What each one really stops

A honeypot catches the cheapest bots, the ones that fill every field they find. Bots that render the page and skip invisible fields walk past it, and so does a person. A CAPTCHA raises the cost for automated traffic, but not to zero: researchers at ETH Zurich reported in 2024 that their model solved 100% of the reCAPTCHA v2 image challenges it faced. Neither stops a person typing a sales pitch. That's why the server side matters as much as the widget: rate limits per visitor, accepting browser posts only from your own site, and a review folder for anything that looks off.

CAPTCHA options and prices

All checked October 2026 on each vendor's pricing page:

• Turnstile works on any site without routing traffic through Cloudflare, with managed, non-interactive and invisible modes. Cloudflare says it processes only the data strictly necessary for the check and doesn't read what visitors type into the form.
• reCAPTCHA offers the v2 checkbox and the invisible, score-based v3. Google became a processor for it on April 2, 2026.
• hCaptcha describes itself as a processor, not a controller, and says it processes data in its main data centers in Europe, and in the US where applicable.
• Friendly Captcha uses no image tasks, and its Advanced plan offers dedicated data centers such as EU only.

Using both

For a busy or valuable form, layer them. Check the honeypot first: it's free and drops the cheap bots before you spend a CAPTCHA check on them. Then verify the CAPTCHA token for everything else, and keep rate limits on the server. Most visitors see nothing at all, and each layer catches what the one before it missed.

Where a form backend fits

If your form posts to a form backend, the server-side part may already be done. OllieLeads, ours, checks a _hp honeypot field, accepts browser posts only from your own sites, rate-limits repeat senders, and moves sudden bursts to a "Possible spam" folder that is never counted or billed. Free covers 500 leads in total; Pro is $29 a month for 1,000 leads a month (pricing, checked October 2026). What a CAPTCHA does better: a script that leaves the honeypot empty and spaces out its posts gets past those checks. If you add one, verify its token on your own server, then forward the lead from there with a server key; the developer docs show how. For the bigger picture, see form backends for static sites.

FAQ

Is a honeypot better than a CAPTCHA?

For most contact and quote forms, start with the honeypot: it stops the commonest bots at no cost to visitors. It's not stronger than a CAPTCHA, though. Add a CAPTCHA when spam keeps getting through, and keep the honeypot as the first layer.

Can bots get past a honeypot?

Yes. Bots that render the page can spot hidden fields and leave them empty, and scripts that post straight to your server never see the form. Changing how the field is hidden helps for a while; a CAPTCHA or rate limits handle the rest.

Is reCAPTCHA GDPR compliant?

Google says it is, and commits to the GDPR in its Cloud Data Processing Addendum; since April 2, 2026 it acts as your processor. That doesn't settle the ePrivacy question of whether its script needs consent on your site, which depends on national law and your authority's guidance. You remain the controller and must tell visitors about it. This page is not legal advice.

Which CAPTCHA is the most accessible?

The W3C's note concludes there is no single ideal solution. Modes that ask nothing of the visitor are the gentlest (Turnstile's non-interactive and invisible modes, reCAPTCHA v3, Friendly Captcha), and Cloudflare says Turnstile meets WCAG 2.2 AA. Test on your own form with a keyboard and a screen reader.

Is Cloudflare Turnstile free?

Yes. The free plan includes unlimited challenges and up to 20 widgets with 10 hostnames each, and your site doesn't need to run through Cloudflare. Enterprise adds unlimited widgets and longer analytics (checked October 2026).

Published with SuperDuperSEO