Honeypot

Many bots fill every input they can find. A honeypot gives them one field that people never use.

Add _gotcha to your form and leave it empty:

<div hidden>
  <label>
    Leave this field empty
    <input type="text" name="_gotcha" tabindex="-1" autocomplete="off">
  </label>
</div>

If the field arrives with a value, Form Plume returns a normal-looking success response to the bot but does not store the submission or send notifications.

Keep it invisible to people

Do not use type="hidden". Basic bots understand hidden inputs. Hide a normal input from the layout and keyboard instead.

A honeypot has no challenge and no third-party script. It is a good default, but it should be one layer of your spam protection rather than the only one.