Nobody wants to click on traffic lights: how modern sites stop contact-form spam

You have solved these puzzles. Click every square with a traffic light. Now the crosswalks. Now the motorcycles — wait, does the mirror count as part of the motorcycle? Try again.

That is a CAPTCHA, and somewhere along the way we all accepted it as the toll for using the internet. But on your own website, the math is different. That puzzle is standing between a homeowner and your inbox — someone who was about to hand you their name and number, being asked to prove they deserve to. Some of them will not bother. You will never know, because the ones who give up do not leave a trace.

The reason the puzzle exists is real, though. So before throwing it out, it is worth understanding what it was protecting you from — and what does that same job today without the tolls.

Why your contact form gets spammed

There are programs — bots — that do nothing but crawl the web all day looking for forms to fill out. Any form. Yours included. They paste in links to sketchy websites, pitches for “guaranteed #1 on Google” services, and gibberish that exists mostly to test whether your form is unguarded. If it is, you go on a list, and the volume goes up.

An unprotected contact form on even a modest local-business site can pull in a handful of junk submissions a day. That is not catastrophic, but it is corrosive: every fake lead is a small tax on your attention, and the day you skim past a real homeowner because their message was sandwiched between two spam pitches, it has cost you actual money.

So the protection is not optional. The question is what kind — because the old answers charge the wrong person.

The old fixes, and what they cost you

The image puzzle. The classic CAPTCHA works by making the visitor do something computers used to be bad at. Two problems. First, the friction lands on your customer — often a homeowner on a phone, maybe standing in a driveway with a contractor’s card in the other hand, now squinting at blurry fire hydrants. Accessibility is worse: for someone with low vision, those puzzles can be a wall. Second, the premise has quietly expired — modern bots solve image CAPTCHAs about as well as people do, and spammers rent services that solve them in bulk for pennies. You are paying real friction for expired protection.

The quiz question. Then there is the form that asks “What is 1 + 3?” or “Which of these animals can fly?” It feels clever — a human check without the blurry photos. In practice it stops almost nothing. The question never changes, so a spammer’s software learns the answer once and types it forever. And most of these are checked in the browser itself rather than on your server — which means a bot that skips the browser and posts straight to your form never even sees the question. It is a lock drawn on the door in marker.

The modern approach: check the browser, not the human

The current generation of tools flips the whole idea. Instead of quizzing the person, they quietly examine the visit — and the one our sites use is Turnstile, made by Cloudflare, the company that sits in front of a huge share of the internet’s traffic. This is infrastructure, not a plugin somebody is selling.

When someone opens a page with a Turnstile-protected form, it runs a series of small, invisible tests in the background: does this look and behave like a real browser, with the quirks real browsers have, or like a script pretending to be one? It hands the browser small proof-of-work problems — busywork a real device solves in a blink. If the visit passes, Turnstile issues a one-time token, and most visitors never see or click anything at all. Only when it is unsure does it show its worst case: a single checkbox.

The whole “puzzle,” on our own contact form. Most visitors never even see this — the check passes silently. When Turnstile is unsure, this one checkbox is as hard as it gets.

The other half happens where visitors cannot see it. That one-time token travels with the form submission, and our server hands it back to Cloudflare to confirm it is genuine before the message is accepted. That server-side confirmation is the part the “what is 1 + 3?” form never had — it protects the form itself, not just the page around it.

One more thing worth knowing: unlike some older tools, it never harvests visitor data for ad targeting. The check is about this visit, not about building a profile of the person making it — which matters, because the person making it is your customer.

We can vouch for the “catches robots” part firsthand. To take these screenshots, we pointed an automated browser at our own contact form — a legitimate tool, doing exactly what a polite bot does. Turnstile showed it the checkbox, and when our robot clicked, it was refused:

Our own screenshot robot, caught in the act. A human clicking the same checkbox passes; the automated browser was refused.

Turnstile is not the only one

The same idea ships under several names. Google’s reCAPTCHA v3 is the most common — the invisible successor to its own traffic-light puzzles, scoring each visit silently in the background. hCaptcha does the same job independently, and privacy-focused options like Friendly Captcha and ALTCHA have the visitor’s device do the blink-of-an-eye busywork instead. If your form already uses one of these, you are in reasonable shape.

The specific brand matters less than the generation. If your form’s spam protection quizzes the human, it is the old kind. If it checks the visit, it is the new kind.

One lock is good — layers are better

On the sites we build, Turnstile is the headline act but not the whole defense. Before a submission ever reaches it, it has to get past a quieter check: a honeypot — a form field that human visitors never see, because it is hidden from the page. Bots do not look at pages the way people do; they read the form’s code and fill in every field they find. Any submission with the invisible field filled out came from a bot, no puzzle required. Better still, the bot is told “message sent!” and wanders off satisfied, none the wiser.

Then comes Turnstile, and both checks happen on the server — the one place a bot cannot skip. Neither asks your customer to do anything. That is the standard worth holding any modern form to: the suspicion should be spent on the software, never the person. It is the same logic as cutting the clutter that quietly costs you trust — every hoop you remove is a lead you did not lose.

The honest part: nothing is foolproof

Here is what no vendor page will lead with: none of this stops a person who wants to waste your time. A human being can pass every check ever devised and then type a fake name, an invented phone number, and a nonsense project into your form — because every one of those checks asks “is this a human?”, and the honest answer is yes. The occasional sophisticated bot slips through too; this is an arms race, and defense never retires.

That is fine, because it is not the job. The job is to stop the automated flood — the 95-plus percent of junk that arrives by script — without turning away a single real customer. Getting a homeowner to reach out at all is hard enough; a form that makes them solve puzzles to give you money has the trade exactly backwards.

Common questions

Will real customers ever see a puzzle?

Not with the modern tools. Most visitors see nothing at all; when Turnstile is unsure, it shows a single checkbox — one click, no traffic lights. The image puzzles belong to the older generation.

Does this cost money?

It should not. Tools like Turnstile cost nothing, and most modern form plugins and website builders can use one with a small amount of setup. If your web person says spam protection requires a monthly fee, ask what exactly you are paying for.

My form asks a math question — am I at least partly protected?

Barely. It filters the laziest bots and none of the rest, and the protection usually lives in the browser, where bots are free to ignore it. If spam is still getting through your quiz question, this is why.

If your form is running puzzles from 2015 — or running nothing and you have stopped checking the inbox it feeds — reach out. We are glad to take a look at what is actually protecting it.