Skip to content

How to remove the CAPTCHA from your contact form

CAPTCHAs cost real visitors time and still let sales pitches through. How to take yours off without letting the bots back in: what to keep, what to check first, and what to watch afterwards.

Updated

Most CAPTCHAs on small business contact forms went on after a bad week of spam, and stayed on. They do stop the simplest bots. They also make every customer do a chore before they can ask you anything, and they do nothing about the sales pitches typed by people.

You can take the CAPTCHA off without letting the bots back in. The trick is to replace it with defenses your visitors never see, then check one setting that a CAPTCHA was quietly protecting.

What the CAPTCHA is costing you

In a 2023 study presented at USENIX Security, 1,400 people solved 14,000 real CAPTCHAs of the kinds websites use today.

  • They're slow. People took 15 to 26 seconds on a reCAPTCHA picture challenge, and 18 to 32 seconds on hCaptcha.
  • People fail them. About 81% got reCAPTCHA picture challenges right. On hCaptcha, 71 to 81% did.
  • People leave. Between 18% and 45% of participants quit after their first CAPTCHA, and they were being paid to finish. A customer on your site isn't.
  • Bots do as well or better. Comparing its results with published bot attacks, the study found bots can match or beat people on speed and accuracy across the CAPTCHA types it could compare. Bots that can't solve one can pay a service such as 2Captcha about $1 to $3 per thousand to have people do it.

Then there's accessibility. The W3C's accessibility group puts it plainly in Inaccessibility of CAPTCHA: "the very nature of the interactive task inherently excludes many people with disabilities."

Before you remove it: turn on defenses visitors never see

Form plugins move their settings around between versions, so if a name below doesn't match your screen, look in the form's spam protection or security settings.

A honeypot

A honeypot is a hidden field that people never see and simple bots fill in. If it has anything in it, the submission is treated as spam. The W3C document above says a honeypot "should be considered" for exactly this reason: it costs real visitors nothing.

  • WPForms has built-in anti-spam protection that works in the background. It's usually on for new forms; check older ones.
  • Gravity Forms has an anti-spam honeypot option in each form's settings.
  • Elementor Pro forms have a honeypot field you can add.
  • Contact Form 7 relies on add-on plugins for a honeypot, and free ones exist. See our Contact Form 7 guide.
  • Webflow takes custom code for a honeypot. See our Webflow guide.

What it misses: bots written to skip hidden fields, and every human.

Akismet, if you're on WordPress

If you already run Akismet, most WordPress form plugins can pass submissions through it. It's good at known spam sources and repeated junk, with nothing for visitors to do. It's free for personal sites; business sites are expected to pay.

An invisible check, only if bots flood you

If you get thousands of bot submissions a month, a honeypot may not be enough. A check visitors don't interact with is the next step: Cloudflare Turnstile has non-interactive and invisible modes and a free plan, and reCAPTCHA v3 scores visitors without a puzzle. Both load a script from Cloudflare or Google on your page, which your privacy policy should cover. Turnstile's recommended managed mode can still show some visitors a checkbox, so choose the mode on purpose.

Check one setting first: does your form email the visitor?

Some forms send the person who filled them in a copy of their message, or a confirmation email. With no bot check at all, a bot can type someone else's address into your form and use it to mail them, and that mail comes from your website.

If your form does this, either turn the copy off or keep a honeypot or invisible check in place. A plain thank-you page does the same job for real visitors without the risk.

Take the CAPTCHA off

  1. Remove the CAPTCHA field from each form, or switch CAPTCHA off in the plugin's spam protection settings.
  2. If you added your CAPTCHA keys in a separate plugin or in your site's settings, remove them there too, so the script stops loading on your pages.
  3. Send yourself a test message from a phone and from a computer.
  4. Update your privacy policy if it mentioned the CAPTCHA provider and you no longer use them.

Watch the first week

Look at what arrives, and sort it into three piles in your head.

  • Bot junk (gibberish, link drops, the same message over and over): your honeypot isn't catching enough. Add Akismet or an invisible check.
  • Sales pitches and AI-written spam (SEO audits, redesign offers, polite messages that want something): a CAPTCHA wasn't stopping these before, either. A person or a well-built bot wrote them, so the fix is a filter that reads the message.
  • Real customers: the point of all this. With the puzzle gone, you may well see more of them.

Where Ascue fits

Ascue handles the middle pile. It reads every message after it's sent, with a one-sentence description of your business, and labels it: Lead is delivered right away, Pitch is held for a weekly digest, Spam is blocked and kept for 30 days, and Ask me is delivered marked "Ascue wasn't sure". It adds nothing to your pages with email forwarding, and your visitors see the same form and thank-you page as before.

Messages Ascue sorts count as checks, though obvious junk, repeats and anything it blocks during a bot attack are free. Keep the honeypot anyway: it stops simple bots before they reach Ascue. If you ever run past your plan's monthly checks, messages are delivered unsorted, never dropped. It works with any form through email forwarding, and there's a WordPress plugin with an invisible browser check built in. See how it compares with a CAPTCHA.