Honeypots, rate limits and Turnstile: anti-spam without annoying humans
Modern spam protection is invisible to people and expensive for bots. How honeypots, rate limits and Turnstile work together, and why we dropped captchas.
The short answer
The goal of spam protection is not to prove that a visitor is human. It is to make each junk submission cost a bot more than it is worth, while costing a real visitor nothing. Three layers do that: a honeypot, a rate limit and a silent browser check. All three run on the server, and none of them asks a person to click on bicycles.
Layer by layer
Cost to a real visitor: nothing. Cost to implement: a few lines. Catches: the majority of low-effort bots, which is the majority of bots.
Cost to a real visitor: nothing, unless they submit the same form ten times in a minute. Catches: floods, brute-force attempts, and bots that learned to skip the honeypot but not to slow down.
Cost to a real visitor: almost always nothing. Catches: bots that behave like scripts even when they fill forms carefully and slowly.
How they fit together
| Bot type | Honeypot | Rate limit | Turnstile |
|---|---|---|---|
| Fills every field, fast | Caught | Caught | Not needed |
| Skips hidden fields, fast | Passes | Caught | Not needed |
| Careful and slow, scripted | Passes | Passes | Caught |
| A human paid to type | Passes | Passes | Passes; filter on content instead |
The order matters. The cheap checks run first, so the more expensive check rarely runs, and a real visitor meets none of them.
Why we stopped using picture captchas
- They punish the wrong party. Every visitor pays with time and irritation; the bot operator pays a solving service a fraction of a cent.
- They exclude people. Visual puzzles fail visitors with impaired vision and many others; the audio alternatives are often worse.
- They cost conversions. A person about to send a real enquiry meets a puzzle and a share of them leave. That share is your cost, and it is invisible.
- They are solved anyway. Automated and human-powered solving services make classic captchas a speed bump, not a wall.
The rule underneath all of it
What this means for you
If your forms use a picture captcha, you are paying in conversions for protection that works less well than three invisible layers. If your forms have no protection and spam has arrived, add the three layers in order, on the server. Either way, use the next spam wave as a prompt to check that the form validates its input properly, because the bots that fill your inbox are the same ones that probe for real weaknesses.
Frequently asked questions
What is Turnstile and how is it different from a captcha?
Turnstile is Cloudflare's replacement for captchas. It runs a set of checks in the visitor's browser without asking them to solve anything, and only shows a visible step, usually a single click, when the signals are unclear. Most humans never see anything. It confirms the result to your server, which is where you enforce it.
Do these layers stop all spam?
They stop the automated flood, which is nearly all of it. A human paid to fill in forms by hand gets through any protection, because they are a human filling in a form. If that happens at scale, the answer is filtering on the content and the source, not a harder puzzle for everyone else.
Is a honeypot enough on its own?
For a low-traffic site it removes most junk. Smarter bots learn to skip hidden fields, and floods from one source still arrive. The three layers together cover the cases a single one misses, and each costs almost nothing.
Why does it matter that checks run on the server?
A bot does not use your page; it sends the request directly to wherever the form posts. Any check that only runs in the browser is skipped entirely. The server must verify the honeypot is empty, count submissions per source, confirm the Turnstile result, and validate every field itself.
Sources
- Cloudflare Developers: Turnstile (accessed 2026-09-11)
- OWASP Cheat Sheet: Input Validation (accessed 2026-09-11)