Bots filling the portfolio contact form do not always deserve a captcha. A hidden field + throttle already cleans house.
Progression
- Honeypot (hidden
websitefield via CSS /tabindex=-1) - Per-IP rate limit + soft signature
- Captcha (Configuration → Security flag) if volume rises