It appears that some spam messages can get through reCaptcha so would there be another additional step to check if there is an actual human submitting forms? And would it make sense to have this additional check, considering that a human could be the one sending these messages?

  • Really. have you talked to your users? The captchas are bad enough now. You just have to live with the odd leak. Nov 9, 2022 at 19:04

1 Answer 1


You could additionally add a honeypot. This is a "trap" for bots. For example, a text field is hidden for real users, but it is visible for the bot and it fills it. If the field is filled in, the request is ignored. There are also plugins that can support you with this.

Another idea would be to generate an (in the backend) encrypted time stamp and send it with the request. You can then decrypt it and check how long the user or bot needed to fill the form. If it was too fast, way too slow or not a time stamp, the request is ignored. You may also want to ignore requests at the exact same time.

They are not 100% solutions, but ones that do not bother your users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.