Lately I am getting more and more spam in my forms. Including sign up forms, which is annoying because it messes up your funnel, pollutes your db and statistics.

Privacy is an important topic for me, so reCAPTCHA from Google a big no. Services like hCaptcha and Akismet seem more privacy friendly though.

The best option is of course something that works locally. A honeypot field and CSRF are pretty simple and straightforward strategies to use. But bots sadly get smarter and smarter. Does anyone have (js) libraries, strategies or tips that can be used to fight this problem?