How to stop bots submitting your forms on WordPress and Webflow

Form spam is the point where bot traffic stops being a reporting problem and starts costing money: polluted CRM records, sales reps chasing fake leads, email deliverability damaged by bouncing addresses, and marketing attribution built on garbage.

Why CAPTCHA is the wrong first move

A visible CAPTCHA measurably reduces conversion, and modern solving services defeat it for fractions of a cent. Use it as a last resort for a specific abused endpoint, not as your default defence.

Layer 1 — Honeypot field

Add an input that is hidden with CSS and left empty by humans. Naive bots fill every field they find. Reject the submission if it has a value. Zero friction, catches a surprising share of unsophisticated spam.

<input type="text" name="company_url" tabindex="-1" autocomplete="off"
       style="position:absolute;left:-9999px" aria-hidden="true">

Layer 2 — Timing check

Record when the form was rendered and compare on submit. A genuine person needs at least two or three seconds to fill in even a short form. Anything faster is scripted.

Layer 3 — Signed token

The strongest layer. Issue a short-lived HMAC token when the form is rendered and verify it server-side on submit. A bot that POSTs directly to your endpoint — never loading the page — has no valid token and is rejected before it touches your database.

WordPress

1. 1Install the Bot Analytics plugin (a single PHP file) and paste your site key.
2. 2The plugin injects the honeypot and token into every form and verifies submissions before your form plugin processes them.
3. 3Contact Form 7, Gravity Forms, WPForms and Elementor forms are all covered, because verification happens at request level rather than per plugin.

Webflow

1. 1Paste the tracking script into Project settings → Custom code → Head.
2. 2The script finds every form on the page and injects the honeypot and signed token automatically.
3. 3Point form submissions at your endpoint, or use the verification call in a Webflow Logic flow, to reject anything without a valid token.

Measure it, or you are guessing

Every rejected submission should be logged with the reason: missing token, expired token, honeypot filled, submitted too fast. Without that log you cannot tell the difference between 'the spam stopped' and 'the form broke'. Bot Analytics records both sides — submissions accepted and bot attempts prevented — on the same dashboard.