Stop spam-bots with Honeypot

A honeypot is a very effective technique to eradicate a spambot problem. It's a very simple concept where a hidden input field is appended to a form. A human won't see this invisible form field, but a bot parsing HTML will.  If the form is submitted with a value for the field then it's assumed the form wasn't submitted by a human and therefore ignored.

Install the Honeypot module:

composer require drupal/honeypot

Within the module's configuration page, check "Protect all forms with Honeypot". If you need to protect specific forms in your code, in your form definition function, or within a hook_form_alter(), call:

honeypot_add_form_protection($form, $form_state, ['honeypot']);

You will see a significant reduction of spambot activity.