A maths captcha with no third party
How the contact form keeps bots out with one addition sum, a honeypot and a rate limit.
Every contact form needs an answer to spam, and the usual answer is to embed someone else's script. reCAPTCHA and its relatives work, but they add a third-party request to every page load, ask a visitor to prove themselves to a company they did not choose to deal with, and quietly add a tracking cookie.
The form here asks a single arithmetic question instead: what is three plus four. The numbers are generated per session, stored on the server with a timestamp, and rendered as a label tied to the input. A bot that cannot read the question fails. A person fails only if they are not paying attention.
Three smaller details make it hold up. The challenge expires after ten minutes, so a harvested answer cannot be replayed later. It is cleared after one use, so a correct answer cannot be submitted twice. And a hidden field sits in the form where a script will happily fill it in and a person never will; anything in that field is discarded without an error message.
Submissions are rate limited per address, and the raw network address is never stored, only a salted hash kept for ten minutes. That is long enough to spot a flood and useless afterwards.
None of this will stop a determined attacker with a real browser. It does stop the background noise, it costs nothing, it depends on no external service, and it does not ask a visitor to identify every traffic light in a grid.