Honeypot is a contributed module that adds a hidden field to forms to catch spam bots. Real users never see or fill in the field, but automated bots filling in every form field get caught.
The module is extremely simple to install and has almost no configuration. Enable it and the protection starts working immediately on forms you select, including comment forms, contact forms, and user registration.
Honeypot has several advantages over CAPTCHA. It does not annoy legitimate users with puzzles or images, it works without JavaScript, and it has no external dependencies. The tradeoff is that it only catches basic bots. Sophisticated spam operations that render JavaScript can bypass honeypot, but those are rare. For most Drupal sites, honeypot catches the vast majority of spam with zero user friction. It is one of the easiest security wins available.