An option that often works well is to use a hidden field. <input type="hidden" name="secretq" value="" /> On process, if there's any value in there, reject it. Bots tend to fill all fields with something.