How do I stop spam from my website contact form?
Layer quiet protections that real visitors never notice: a hidden honeypot field, a background bot check such as Cloudflare Turnstile or reCAPTCHA v3, and your form tool's spam filter. Send caught messages to a spam folder rather than deleting them, and test the form after every change so real leads still get through.
The short version
- Bots find forms automatically; any public form will get some spam.
- Start with protections customers never see: a honeypot and a background bot check.
- Turn on your form tool’s filter and block link-stuffed messages.
- Quarantine caught messages; don’t delete them unread.
- Send a test from your phone after every change.
Why does my form get so much spam?
Automated scripts crawl the web looking for forms to fill with ads and links. Some spam is typed by real people, often selling SEO or web services, and no filter catches all of that. The goal isn’t zero spam. It’s an inbox where real enquiries don’t get buried.
Which protection should I pick?
Work through these layers in order, and stop when the junk is under control.
1. A honeypot field. A hidden field that people never see but bots fill in. Anything that arrives with it filled is rejected. Most good form plugins include one.
2. A background bot check. Cloudflare Turnstile is designed to avoid showing visitors a puzzle, and it can be added to any site without routing traffic through Cloudflare. Google’s reCAPTCHA v3 scores each submission in the background and, in Google’s words, “will never interrupt your users.”
3. Filtering. Turn on your form tool’s spam filter. Block messages packed with links, and block a phrase if the same junk keeps coming back.
4. Form design. Ask only for what you need (see which fields a contact form should have), and don’t print a plain email address on every page, where scripts can harvest it.
Why does it matter?
The real cost of spam is attention. When a form sends a stream of junk, people stop reading closely, and a real enquiry slips past. Spam can also hurt your mail reputation if the form sends a copy to whatever address a bot types in.
What are the common mistakes?
- A hard puzzle CAPTCHA as the first move. It frustrates customers, especially on phones and for people using assistive technology.
- Deleting caught messages unread. Glance at the spam folder weekly to rescue anything real.
- Turning the form off. A missing form loses more business than spam costs.
- Auto-replies to every submission. They’ll go to bots too, and can land your domain on blocklists.
What if spam keeps getting through?
Look at what’s arriving. If it’s clearly automated, the honeypot or bot check may not be working; check it’s switched on for that form. If it’s typed by people, a link filter and blocked phrases help more than any CAPTCHA. If real messages stop arriving after a change, roll it back and see why form emails go to spam or don’t arrive. Comment spam is a separate problem; see how to stop WordPress comment spam.
What does it cost, and how long does it take?
Honeypots and form-plugin filters are often included in the plugin. Cloudflare lists a free Turnstile plan; other services set their own limits. Adding one usually takes under an hour, plus testing.
How does E-3 handle this?
Forms and online orders are among the subjects clients ask us about most. Our leads and follow-up service gathers enquiries into one leads inbox. If spam is swamping your form today, call 814-399-4655.
Related questions
Rather talk it through?
Call our team, or send a note and we’ll reply within one business day. No pressure and no jargon.