Lightweight spam protection with Google Form customization

Google Form customization was previously implemented in response to requests to switch website contact forms to Google Forms.

We've published it as a column, and I'm grateful to see so many people referring to it! Thank you.

Pitfalls when creating your form with Google Form
Implementing a confirmation screen for Google Form customization

In the meantime, we received a request asking if there was a way to protect against the large volume of spam emails being sent.
This time, as the third installment of our Google Form column, we've put together information about spam protection for Google Form customization.

The first countermeasure that came to mind was whether we could implement reCAPTCHA, a free security service provided by Google.

However,

Google Forms does not have a standard setting or toggle called "Enable reCAPTCHA." There is no such option in the form editing screen, and it is correct to understand that this is not an officially provided feature by Google.

Furthermore, upon further investigation, it appears that Google Form's reCAPTCHA operates at Google's discretion, and there is no way to know whether the reCAPTCHA badge will appear or not!

In the first place, Google Form customization requires entering field IDs like entry.386122698 into HTML, making everything visible in plain text. With just this URL and entry ID, it is technically possible to POST directly to formResponse using simple scripts like curl or Python's requests, without even opening the page in a browser.

In fact, most Google Form spam appears to follow this pattern of "bypassing the page and hitting the endpoint directly," and even with reCAPTCHA in place, this remains ineffective on the direct POST route unless token validation is performed server-side via GAS or similar, making it not a fundamental solution.

But there are solutions!

In practice, many spam bots use a generic approach: find a contact form, automatically fill it out, and submit it (a bot that actually renders the page and submits via the DOM).

Against this type of bot, controlling the submit button with JavaScript can be effective. To increase precision, we recommend combining multiple techniques. All of these require only changes to the HTML file—you don't need to modify Google Forms or Google Apps Script at all.

Reference: [reddit] How can I prevent bots from spamming my Google Form and flooding my email?

1. Use JavaScript to generate and display a random arithmetic problem on each page load.

This is a simple formula using Math.floor(Math.random()*9)+1 on both sides. JavaScript generates a random math problem on each page load—for example, "3 + 5 = ?"—and displays it on screen. The submit button remains disabled until the user enters the correct answer.

While this adds some friction for users, generic bots that don't react to UI elements tend to get caught by this approach.

2. Honeypot field (hidden input field) for automatic detection.

Set up a hidden input field using CSS (positioned off-screen) that users cannot see. Humans won't interact with this field, but bots that mechanically fill in all form fields will enter a value here too. If this field contains data on submission, the form submission is canceled.

This is effective against bots that mechanically fill in all input fields on a form (regardless of visibility) and then submit. This type of bot is very common, so this countermeasure can be expected to have a real impact.

Since each type can detect different bots, combining both approaches minimizes the risk of missing spam.

The limitation remains that this approach has no effect against "direct POST-type spam that bypasses the website page."

When a Google Form is directly attacked by spam without going through the website page, you ultimately have to recreate the Google Form itself.

With that in mind, implementing it as a "mitigation strategy for some common bots" should be quite effective!