How to add additional spam injection prevention to my forms? I think CAPTCHA protection is insufficient.

You can add additional spam injection protection to your forms by using a field that must be left empty for a successful submission. The nature of spam bots force them to fill out each form field. This is where we can outsmart them.

Just add some field to your form:

And add following line to your form configuration in config.php file:

And put some description to this field to tell user that it must be left blank for a successful submission.

If user fills this field by mistake, he will see an error message and is able to resubmit correctly. However bots can't read and understand this text and will stuck here.