How to stop spam through your website contact form without blocking real customers

The short answer: quiet checks first, puzzles last

If your contact form fills up with gibberish, link-stuffed messages and fake quote requests, you don't have to choose between putting up with it and making every customer solve a puzzle. Most bot spam can be stopped with checks a real visitor never notices.

Work in layers. Start with a hidden honeypot field, then add an invisible bot check such as Cloudflare Turnstile or Google reCAPTCHA v3, and make sure your website verifies it on the server. If the form is still being flooded, add a rate limit. Keep visible puzzles as a last resort, because they shut out some of the people you want to hear from.

Whatever you add, don't let it quietly delete submissions. Send anything suspicious to a spam folder you check, so a real enquiry that trips a filter can still be answered.

Why form spam costs more than a cluttered inbox

The obvious cost is time. Someone has to read each submission to decide whether it's real, and when the junk outnumbers genuine enquiries, people start skimming. That's when a real customer's message gets deleted with the rest or answered a day late.

The less obvious cost is your numbers. If your thank-you page or form event counts every submission as an enquiry, spam inflates it. Your reports then show more enquiries than you really had, and any ad campaign that's set to find people who submit your form is learning from junk as well as real customers. Clean up the form first, then check that only real submissions are being counted as conversions.

Keep readingTrack where your real enquiries come from

First, work out what kind of spam you're getting

Look at a week of junk before you change anything, because the fix depends on who's sending it. Automated spam tends to show itself: random strings in the name field, messages full of links, every optional field filled in, text in a language your customers don't use, or a burst of submissions within seconds of each other. Bot checks, honeypots and rate limits are built for this kind.

Spam typed by real people looks different. Offers of cheap SEO, app development or guest posts are often sent by hand, one form at a time. No bot check can stop a person who really is a person. For these, a mail filter rule, a short list of blocked phrases in your form tool or simply learning to recognise and delete them is more realistic.

Also check whether the junk is reaching you through the form at all. Spam sent straight to an email address published on your site won't be touched by anything you add to the form.

Start with checks your visitors never see

A honeypot is a form field hidden from people but visible to automated scripts, which tend to fill in every field they find. If the hidden field comes back filled in, the submission is treated as spam. The W3C's accessibility working group, in its note on the problems CAPTCHAs cause, calls this "an approach that is easily implemented even in hand authored markup and should be considered." Many form plugins have it built in, so check your settings before you install anything new.

Honeypots aren't foolproof in either direction. Smarter bots skip hidden fields, and the check itself can fail for real people. Gravity Forms, a popular WordPress form plugin, explains that its newer honeypot relies on JavaScript, so "any JavaScript error may cause the honeypot to fail validation", and caching, script optimisation and plugin conflicts can cause the same problem. Depending on your settings, a failed entry is either discarded or marked as spam. Choose marked as spam, then test the form after every plugin or theme update.

Your website can also reject submissions that couldn't be real before anyone sees them: an email address that isn't a valid format, a phone field full of letters, or a message that's nothing but links. Ask your developer what your form already checks on the server, not just in the browser.

Add an invisible bot check, and verify it on the server

The next layer is a bot check that runs in the background. The two you'll see most often are Cloudflare Turnstile and Google reCAPTCHA v3. Both watch for signals of automation while the visitor uses the page, and usually ask nothing of them.

Cloudflare describes Turnstile as a "smart CAPTCHA alternative" that can go on any website "without sending traffic through Cloudflare", so you don't need to move your hosting. Its free plan allows up to 20 widgets with unlimited challenges, and Cloudflare says Turnstile "does not access, store, or transmit user communications, form entries, or other page inputs." Its recommended managed mode only shows a checkbox when a visitor looks risky.

Google's reCAPTCHA v3 never shows a challenge. Instead it gives each submission a score, where "1.0 is very likely a good interaction, 0.0 is very likely a bot", and your site decides what to do with it. Google suggests starting with a threshold of 0.5, and first running reCAPTCHA without taking action so you can see how your real traffic scores before you block anything. A low score is a good reason to route a submission to review rather than reject it outright.

Here's the part that's easy to get wrong: adding the widget to the page isn't enough. Cloudflare is blunt about it: "The client-side widget alone does not protect your forms." A bot can skip the widget and post straight to your form, so your server has to send each token to Cloudflare or Google to confirm it's genuine. If you've added a bot check and the spam hasn't changed, a missing server-side check is the first thing to look at.

Tokens also expire. Cloudflare says a Turnstile token is valid for 300 seconds and can only be checked once; Google says reCAPTCHA tokens expire after two minutes and that you should run the check when the visitor takes the action, not when the page loads. That matters for a long quote form. If someone takes ten minutes to describe their job and the token has expired, a poor setup rejects a real enquiry. Test your form by filling it in slowly before you trust it.

Don't lock real customers out

Visible puzzles are the layer to add last, if at all. The W3C's note on the inaccessibility of CAPTCHA explains that interactive tests ask people to do something that is easy for humans but hard for robots, and that "the very nature of the interactive task inherently excludes many people with disabilities." Distorted text, picture grids and audio challenges can each stop a customer who is blind, has low vision, is deaf or has a cognitive disability. The same note says many traditional puzzles are no longer especially effective against bots anyway.

If you do need a visible step, choose one with accessible alternatives, and test it with the keyboard alone and on a phone. Cloudflare states that "Turnstile is WCAG 2.2 AA compliant", which is a vendor's claim rather than an independent audit, so check it on your own form as well. Remember that a background check like reCAPTCHA v3 involves a third party too. Google says it sets a necessary cookie, so make sure your privacy information reflects the tools your form uses.

Keep readingRun a quick accessibility check on your form

Keep readingTell people what happens to their details

Slow down floods with a rate limit

Sometimes the problem isn't one bot but hundreds of submissions in an hour. A rate limit caps how many times the same visitor can submit in a short period. If your site already uses Cloudflare, its rate limiting rules are available on the free plan with one rule, which can match a path such as your form's submission address and count requests by IP address over 10 seconds. Paid plans allow more rules and longer periods.

Keep the rule narrow. Cloudflare notes that rate limits aren't precise, so some excess requests can still get through, and that applying them to verified bots might affect SEO. Limit only the address your form posts to, not your whole site, and set the threshold well above what a real person would ever do, such as several submissions in a few seconds.

Never let a filter silently bin a real enquiry

Every layer here can be wrong occasionally. The safest setting is the one where suspicious submissions are kept, labelled and reviewed, not deleted. Check the spam folder in your form tool or inbox once a week, and if you find a real enquiry there, loosen the check that caught it.

Look at your automatic reply as well. If the confirmation email repeats the message a visitor typed, spammers can use your form to send their text to any address they choose, from your domain. Keep the auto-reply short and generic, without the submitted message, and keep your notification emails sending from your own domain so they actually arrive.

Finally, re-test the whole path after any change. Send a labelled test enquiry, confirm it reaches the right person, and check that it's counted once in your reports and that a deliberately spammy test is caught but still visible in the spam folder.

Keep readingStop form notifications landing in spam

A worked example: a Geelong electrician's contact form

This is a hypothetical example, not a client result. An electrician in Geelong notices that most new form submissions each morning are junk: link-filled messages, random names and several arriving in the same minute overnight. A couple of real quote requests a week are getting buried, and one was found days late.

They start by checking their form plugin and find it has a honeypot that's switched off. They turn it on and set failures to be marked as spam. Next, their developer adds Turnstile in managed mode and confirms the server rejects any submission without a valid token, then fills in the quote form slowly to check a ten-minute visit still goes through. The overnight bursts were all hitting the same submission address, so a rate limit on that one path covers them.

The hand-typed SEO offers keep coming, so the electrician creates a mail rule for the phrases they repeat. Each Monday someone spends two minutes checking the spam folder. Their conversion tracking is changed to count only submissions that pass the checks, so the enquiry numbers they compare month to month are real ones.

A form spam checklist

Run through this list when spam starts, and again after any change to your website or form plugin.

• Read a week of junk and decide whether it's automated, typed by people or not coming through the form at all.
• Turn on the honeypot your form tool already has, and set failures to be marked as spam rather than deleted.
• Add Turnstile or reCAPTCHA v3, and confirm with your developer that every token is verified on the server.
• Fill in your longest form slowly to make sure an expired token doesn't reject a real enquiry.
• Add a rate limit on the form's submission address only if you're getting floods.
• Avoid visible puzzles where you can, and test any you keep with a keyboard and on a phone.
• Keep auto-replies short, without the visitor's message, and check the spam folder every week.
• Count only submissions that pass your checks as enquiries in your reports and ad tracking.