I have the following at the bottom of one contact form
<noscript><hr />
Javascript is not enabled. This box is a precaution against abuse. <br />Please <b>LEAVE IT BLANK</b>, or your message will be rejected. <br />Fake number: [+randigit+]
<input type="text" name="captcha" value=" " eform="Abuse blocker:string:1:Must be blank!:#LIST :-], ,">
</noscript>
[+randigit+] is a placeholder generated by a little snippet to produce a PIN-style four-digit fake CAPTCHA. You could just put plain static text in if you prefer. The initial value of the input field is a single space, which is in the list of things that validation will match. I have to confess it’s a while since I did this one, and I don’t remember the details of how I arrived at this validation code, but I just tested it on a local copy of the site, and it works.
It’s rare for bots to do Javascript, and most users have it enabled, so this targets the honeytrap at the bots, and doesn’t bother the humans with pesky semi-legible things to copy. The humans that do run across it just have to believe the message.

KP