What you need to know
Spam can waste time and abuse email providers, but aggressive challenges can block people using assistive technology or mobile devices. A proportionate defense can reduce automated abuse while keeping the form usable.
How to apply it
Validate on the server, add sensible rate limits, use a honeypot or provider-supported challenge where appropriate, and monitor false positives. Keep a clear success and failure message.
Common mistake to avoid
Do not rely only on client-side validation or a hidden field. Attackers can bypass the browser and inspect the form.