Survey Bot Detection Without a CAPTCHA (2026)

What a CAPTCHA does, and what it costs

A CAPTCHA is a fair trade on a login page. On a survey, the trade is worse. Every respondent pays the cost (a puzzle, a delay, a failed attempt on a phone) and some leave. The benefit is partial: CAPTCHA farms solve them for a fraction of a cent each, and the newest AI agents get through too.

Some platforms use invisible risk scores instead. Qualtrics, for example, documents a bot detection feature based on reCAPTCHA scores, where 0.5 or above means "likely human". That's much better for respondents. You still end up trusting one opaque number.

A bigger problem is that CAPTCHAs answer the wrong question. They ask "is this a human?" Most bad survey data comes from humans who aren't reading. A CAPTCHA lets every one of them through.

Five invisible layers

1. A honeypot field

Add a field that's hidden from people but present in the page code, with a tempting name like "website". People never see it. Simple bots fill everything. Return a normal success message either way so the bot doesn't learn it was caught.

One caution: browser autofill and password managers occasionally fill hidden fields for real people. Keep the blocked submissions for a while so you can rescue a real respondent who got caught.

2. A rate limit

Cap submissions per IP address per form, say 10 a minute. It doesn't judge anything, but it turns a flood of 2,000 into a trickle. It won't stop a bot that rotates IP addresses, which is why it's one layer and not the whole answer.

3. A signed session

When the form page loads, the server issues a signed, single-use token. The submission has to bring it back. A script posting straight to your endpoint has no token, and you now know it never loaded the form. The same token lets the server time the response itself, so a bot can't claim it took nine minutes.

4. An invisible browser check

Services such as Vercel BotID run a challenge in the background that checks whether the browser behaves like a real one. Nothing for the person to click. Treat the result as evidence, not a gate: embedded forms and ad blockers can make a real person fail.

5. Score what gets through

The bots that pass layers 1 to 4 are the expensive ones, and they tend to leave traces in the answers: identical timings, duplicate text, contradictions, a run of screened-out attempts from the same device until one qualifies. Checking answers also catches the rushers that no bot defense ever will.

Why flag instead of block

Every bot check has false positives. If you block, a real person gets an error or, worse, a fake success message and their answers vanish. On a paid panel, that can mean someone who did the work doesn't get paid. If you flag, the response lands in a review pile and you decide. One research team whose web survey was overrun found only 363 of 1,624 completions were likely valid, and named over-reliance on a single third-party fraud tool as part of what went wrong. Keep the evidence and the decision with you.

How SiliForm does it

SiliForm doesn't use a CAPTCHA. On every plan, forms have a hidden honeypot and a rate limit of 10 submissions a minute from one IP address on each form. Spam trap hits are kept for 30 days under "Blocked by spam trap" on the Responses page, so you can rescue a real person caught by autofill.

On the Pro plan, forms also get signed sessions, server-timed completion, Vercel BotID at submit and full quality scoring. A response with no form session or a bot verdict is marked with the reason (for example "Submitted by an automated browser or script") and lands in Review, or Flagged when other evidence agrees. Nothing is silently thrown away, and one switch removes flagged responses from your charts and exports.

Bots aren't the only problem: AI answer validation catches people who type nonsense to get through. If most of your spam arrives through a sign-up or contact form, see lead generation forms.

Frequently asked questions