Why I Took the CAPTCHA Off My Own Contact Form

For a while my contact form made every visitor tick a “prove you’re human” box before they could reach me. The spam still came. Not as much, but enough that I’d open my inbox to the same gibberish, now wearing a little badge saying a robot had certified it as not-a-robot. One morning, deleting yet another, I caught the absurdity: I was charging a toll to the exact people I most wanted to hear from, and barely inconveniencing the ones the toll was meant for.

So I took the box off. Spam went down, not up. And the people I actually wanted to reach stopped having to earn the right to send me a message. That sounds backwards, so let me be precise about the call, because the mechanics matter less than the decision behind them.

TL;DR

• A puzzle that taxes every real visitor to catch a few bots is a bad trade, and a hire-me page can’t afford to lose the genuine messages.
• I removed the friction instead of adding more, and the spam still dropped: the quiet defence that replaced it is invisible to real people.
• I also refused to hand the form to a third-party widget: the front door is too important to rent.

What the checkbox was actually costing me

Those “prove you’re human” challenges are never free. Some visitors give up partway. Some can’t solve them at all, a genuine barrier for anyone with a visual or motor impairment. And they keep getting harder as the bots get smarter.

For a personal site that exists to start conversations, that’s the worst possible place to lose people. The contact form is the one moment a stranger decides I’m worth the effort of writing to. I was degrading the experience for the visitors I wanted, to mildly annoy the ones I didn’t.

The quieter way to handle it

Once I framed it that way, the answer was obvious. Stop asking the human to prove anything. Instead, let the bot give itself away.

The cleaner approach flips who carries the burden. A real person using a normal browser sails straight through and never notices a defence was there. A bot behaves like a bot, and that’s exactly what gives it away. I’ll skip the exact recipe: a published step-by-step just teaches the spammers what to dodge, and the recipe was never the point anyway. The judgment was: a puzzle makes everyone prove they’re not a robot; the quieter approach lets only the robots out themselves.

It isn’t perfect; the cleverest bots can learn to dodge a known trick. But it stops the overwhelming bulk of automated junk at zero cost to my real visitors, a far better deal than asking everyone to solve puzzles forever.

The part I think about more: don’t rent your own front door

There was a second decision, and it’s the one I’d actually defend in a meeting.

The easy path would have been to drop in a popular third-party verification widget and move on. Free, a few minutes’ work, everyone uses it. But a contact form is where my visitors’ messages and some of their data pass through on the way to me. Handing that to an outside service means a stranger now sits between me and the people trying to reach me. If their widget breaks, my form breaks. If they change their terms, my front door changes with them. And I’d be quietly feeding visitor data to a third party that my visitors never agreed to.

So I kept it in my own hands. Not because building it myself is clever, but because some touchpoints are too important to outsource. The rule I’d hand to anyone running a site or a product: rent the things that don’t matter if they wobble, and own the few that would genuinely hurt you if a vendor pulled the rug.

What this means if you run a site or a product

Look at where you make honest customers prove themselves. If your contact form, signup, or checkout leans on verification puzzles, you’re probably losing real people to friction you could simply remove. The better first question is whether you can take a hurdle away and still catch the bad actors by what they do differently.

The reflex with spam, and with most problems, is to make everyone do more. The better move was to make my real visitors do less, and to keep the door they knock on in my own hands. So look at your own forms and dependencies: where are you charging your best customers a toll to be let in, and which of your critical front doors have you quietly handed to someone else?