bot check on forms

A bot check is a small test built into a web form that tries to answer one question before the form is allowed to submit: is a real person filling this out, or is a script doing it automatically. Forms on the open internet get hit constantly by automated tools trying to submit junk, whether that is spam links, fake enquiries, or attempts to find a weakness in how the form processes what it receives. A bot check is what stands between that traffic and your inbox.

The version most people have run into is the old style, a box of distorted letters to type in, or a grid of images asking you to click every one with a bus in it. That kind works, but it slows down and annoys the real people it was never meant to stop. Newer approaches, like Cloudflare’s Turnstile, run mostly invisibly, checking signals in the background and only asking a visitor to do something visible in the rare cases where it cannot tell automatically.

Why it matters to you

Every form on your site that a stranger can submit is a target for automated spam, and it does not take a determined attacker, just an automated tool sweeping the internet for forms it can post to. Without a check in place, that traffic mixes with your real enquiries, and either you spend time sorting genuine leads from garbage, or worse, a real lead gets missed in the noise.

It also protects the systems behind the form. A flood of automated submissions is not just annoying, it is a load on whatever processes and stores that data, which matters when form spam is left unchecked long enough to become a volume problem rather than a nuisance.

How I set it up

I add a bot check to any form that accepts input from the public, most often the contact and enquiry forms that feed lead capture. I favour Turnstile over an older CAPTCHA because it does its job with far less friction for a real visitor, and because it is built by the same network the site already sits behind, so there is no separate account or service to wire in.

This runs alongside a WAF, which looks at the request itself for attack patterns. The bot check specifically answers the human-or-not question for that one form, which is a narrower and more specific job.

What it looks like in practice

Most visitors filling out a form never notice anything, because the check runs in the background and passes silently. Occasionally, on a connection or browser that looks unusual to the system, a visitor might see a brief one-click confirmation before the form submits. What you, the business owner, see is an inbox with real enquiries in it, and none of the obvious automated junk that would otherwise be mixed in.