Spam on a public booking page is inevitable — bots discover booking forms fast and fill them with junk. Two common defenses: honeypot fields (a hidden field bots fill in but humans don't) and reCAPTCHA v3 (Google's invisible bot score). Here's how to pick.
How honeypots work
A hidden input field — invisible to users, visible to bots — that must remain empty on submission. Bots fill every field they see; if the honeypot is filled, the submission is silently dropped. Zero third-party calls, zero cookies, zero fingerprinting.
Why honeypots aren't enough for public booking pages
Sophisticated bots parse CSS and skip hidden fields. For low-volume, low-attention booking pages, honeypots alone catch 80%+ of spam. For high-value, widely-shared links, you need more.
How reCAPTCHA v3 works
Google's script runs invisibly on the page, computing a bot score based on user behavior, IP reputation, and fingerprint signals. Score below 0.5 = likely bot; dropped server-side. No challenge for the user to solve — it's invisible.
The privacy trade-off
reCAPTCHA v3 sends browser-level signals to Google, which is a privacy concern for strict users. For most business booking pages, the protection outweighs the cost — and Cal Clear lets you turn reCAPTCHA off per link if you'd rather not load it.
Cal Clear's hybrid approach
Cal Clear doesn't use a honeypot field. It uses reCAPTCHA v3 plus per-IP rate limiting by default, and you can turn reCAPTCHA off per link if you'd rather not load a Google script. Optional email verification is also available. All of it is free.
This is part of our privacy-first scheduling pillar guide — 18 articles covering every privacy angle.
Frequently Asked Questions
Does Cal Clear require reCAPTCHA?
It's on by default, but not required. Cal Clear's default anti-spam stack is reCAPTCHA v3 plus per-IP rate limiting; you can turn reCAPTCHA off for any link and keep rate limiting and optional email verification.
Can I use my own CAPTCHA?
Not today. You can turn reCAPTCHA off for any link, but Cal Clear doesn't support hCaptcha or custom challenges. For most users, the default anti-spam is sufficient.
Try privacy-first scheduling, free
Cal Clear runs no analytics or ad trackers on booking pages and auto-deletes booking data on your schedule. Start at calclear.app.