Every public form on the internet gets found by bots eventually. It doesn't matter whether it's a contact form on a plumber's website or a multi-page application form for a membership organisation — if it accepts text and sends an email, something automated will try to use it.
When I built PostBox, spam protection wasn't something I wanted to bolt on later or keep behind the Pro upgrade. A form that fills your inbox with junk isn't a working form. So before getting into captcha choices, it's worth being clear about one thing: the free version of PostBox and PostBox Pro have the same spam protection. Pro adds multi-page forms, conditional logic and file uploads. It doesn't add a better lock on the door.
Three layers, two of them always on
Both versions protect every form with three layers. Two of them run automatically and can't be switched off.
1. Honeypot (always active)
Every form includes a hidden field that real visitors never see. Basic bots fill in every field they find, including that one. When the honeypot is filled, PostBox discards the submission — but returns a normal success response. The bot thinks it worked and moves on, rather than retrying with a different approach.
It costs your visitors nothing: no puzzle, no checkbox, no third-party script.
2. IP rate limiting (always active)
PostBox limits how many submissions a single IP address can make to a form within a time window. You set both numbers under Options → Rate Limiting: the maximum submissions and the time window in minutes.
A real person rarely needs to submit the same contact form more than two or three times in ten minutes. A script trying to flood your inbox needs to do it hundreds of times. Rate limiting doesn't stop a single spam submission, but it stops a single source turning into a flood.
3. Captcha (optional)
For forms that still attract spam after the first two layers, PostBox supports two captcha providers: Cloudflare Turnstile and hCaptcha. You add your keys once in the component options, then switch captcha on per form from the Spam & GDPR tab. That means your busy contact form can have a captcha while a members-only form behind a login doesn't need one.
Turnstile or hCaptcha?
Both are free to start with, both are verified server-side by PostBox, and both work identically in the free and Pro versions. The difference is mostly what your visitors experience.
| Honeypot + rate limiting only | Cloudflare Turnstile | hCaptcha (free plan) | |
|---|---|---|---|
| What visitors see | Nothing | Usually a silent check; occasionally a single click | A checkbox, and more often an image challenge |
| Cost | Free | Free | Free; paid plans add a low-friction passive mode |
| Account needed | No | Free Cloudflare account | Free hCaptcha account |
| Third-party script | None | Yes (Cloudflare) | Yes (hCaptcha) |
| Best for | Low-traffic forms, most small business sites | Most sites that need a captcha | Sites that want a visible challenge, or already use hCaptcha |
Cloudflare Turnstile
Turnstile is my default recommendation. Most visitors pass without doing anything — the check happens quietly in the background, and only suspicious traffic gets asked to click. It's free, Cloudflare doesn't fund it through advertising, and you don't need your site on Cloudflare's network to use it. You just need a free account to generate keys.
One thing to watch: visitors on VPNs or privacy-focused browsers can see challenges more often. If your audience leans that way, test the form on a VPN before going live.
hCaptcha
hCaptcha has a strong privacy focus and has been around longer as a reCAPTCHA alternative. The trade-off is friction: on the free plan, visitors are more likely to see an image challenge. Its low-friction passive mode is part of the paid Pro plan, which is hard to justify for a contact form. If you already use hCaptcha elsewhere, or you actually want visitors to see a challenge, it's a solid choice.
What about reCAPTCHA?
PostBox doesn't support Google reCAPTCHA, and that's deliberate. Google has moved reCAPTCHA onto Google Cloud, with a free allowance of 10,000 assessments a month shared across your Cloud organisation and billing required beyond that. For an agency running forms across many client sites, that shared cap adds up quickly. Add the privacy questions that come with Google's scripts, and the two alternatives are simply a better fit for most Joomla sites.
Security beyond spam
Spam is the visible problem, but a few other protections run quietly in the background:
- Joomla form tokens — every submission is checked against Joomla's CSRF token. On sites with aggressive page caching, the token is fetched fresh on submit so cached pages don't break your forms.
- Server-side validation — required fields, email formats and the GDPR consent checkbox are all checked on the server, not just in the browser.
- File upload checks (Pro) — each upload field has its own allowed file types and size limit, enforced in the browser for immediate feedback and validated again on the server.
- Data retention — set how long submissions are kept, per form or site-wide, and a scheduled task purges anything older. The safest data is data you no longer hold.
A sensible setup for most sites
- Start with the defaults. Honeypot and rate limiting are already on.
- Set a rate limit that suits the form — a contact form might allow three submissions per IP in ten minutes.
- Watch your submissions for a week or two. If spam still gets through, add Turnstile to that form.
- Turn on a data retention period and create the purge task under System → Scheduled Tasks.
- Update your privacy policy to mention the captcha provider, and the IP address and browser details stored with each submission.
If you're using ConsentLab for cookie consent, it's worth listing your captcha provider there too, so your disclosures stay in one place.
Final thoughts
Good form security shouldn't be something you pay extra for, and it shouldn't make your genuine visitors solve puzzles. Most spam is stopped before a captcha is ever needed. When it is, Turnstile keeps things invisible for nearly everyone.
If you followed my earlier guide on creating a simple contact form in Joomla, step six was "add spam protection". This is the longer answer.