How to stop bots submitting your forms on WordPress and Webflow
Honeypots, timing checks and signed tokens — a layered approach to form spam that does not put a CAPTCHA in front of real customers.
Form spam is the point where bot traffic stops being a reporting problem and starts costing money: polluted CRM records, sales reps chasing fake leads, email deliverability damaged by bouncing addresses, and marketing attribution built on garbage.
Why CAPTCHA is the wrong first move
A visible CAPTCHA measurably reduces conversion, and modern solving services defeat it for fractions of a cent. Use it as a last resort for a specific abused endpoint, not as your default defence.
Layer 1 — Honeypot field
Add an input that is hidden with CSS and left empty by humans. Naive bots fill every field they find. Reject the submission if it has a value. Zero friction, catches a surprising share of unsophisticated spam.
<input type="text" name="company_url" tabindex="-1" autocomplete="off"
style="position:absolute;left:-9999px" aria-hidden="true">Layer 2 — Timing check
Record when the form was rendered and compare on submit. A genuine person needs at least two or three seconds to fill in even a short form. Anything faster is scripted.
Layer 3 — Signed token
The strongest layer. Issue a short-lived HMAC token when the form is rendered and verify it server-side on submit. A bot that POSTs directly to your endpoint — never loading the page — has no valid token and is rejected before it touches your database.
WordPress
- Install the Ocli plugin (a single PHP file) and paste your site key.
- The plugin injects the honeypot and token into every form and verifies submissions before your form plugin processes them.
- Contact Form 7, Gravity Forms, WPForms and Elementor forms are all covered, because verification happens at request level rather than per plugin.
Webflow
- Paste the tracking script into Project settings → Custom code → Head.
- The script finds every form on the page and injects the honeypot and signed token automatically.
- Point form submissions at your endpoint, or use the verification call in a Webflow Logic flow, to reject anything without a valid token.
Measure it, or you are guessing
Every rejected submission should be logged with the reason: missing token, expired token, honeypot filled, submitted too fast. Without that log you cannot tell the difference between 'the spam stopped' and 'the form broke'. Ocli records both sides — submissions accepted and bot attempts prevented — on the same dashboard.
