noCAPTCHA.

Filter contact-form spam without asking visitors to solve a puzzle. Try the form, then see what the server noticed.

Try the form

Use a made-up name and message.

Try a bot submission

Run an example through the same PHP checks.

Layer monitor

PHP checks these layers when you submit.

Form tokenWaiting for submission.
Timing & browserWaiting for submission.
Text honeypotWaiting for submission.
Inverted checkboxWaiting for submission.
Repeat messagesWaiting for submission.
Submission limitsWaiting for submission.

Ready to check

Submit the form or run a bot example to see the result here.

What runs behind the form

Form token: PHP signs the token, checks its age, and tracks whether it was used.
Timing & browser: PHP measures the form’s age. JavaScript can report the first edit and whether the browser reports WebDriver control.
Text honeypot: An empty hidden field catches bots that fill every text input.
Inverted checkbox: JavaScript clears a hidden checkbox that simple bots may check again.
Repeat messages: PHP compares recent messages using a keyed fingerprint.
Submission limits: PHP counts recent submissions per client and per form.

Help catch bots. Leave people out of it.

Have a signal that catches spam without making visitors jump through hoops? Bring your idea, a test case, or a new layer to the noCAPTCHA GitHub project.

Contribute on GitHub