How do I stop spam coming through my website form?

How do I cut form spam?

1. Turn on the honeypot. A honeypot is a hidden field people never see. Bots fill it in, which gives them away. In Gravity Forms, open the form, go to Form Settings, find Spam Detection, and turn on Detect spam using the Advanced Honeypot, as Gravity Forms describes in its spam protection first steps. In WPForms, open the form builder, go to Settings, Spam Protection and Security, and check Enable anti-spam protection is on. WPForms turns it on by default for new forms. Contact Form 7 has no honeypot setting of its own: go to Contact, then Integration, and set up Cloudflare Turnstile or reCAPTCHA, as its Turnstile guide shows.
2. Keep spam entries for review. Paid versions of WPForms have a Store spam entries in the database setting, on by default. Gravity Forms keeps flagged entries in Entries under the spam filter, depending on your settings. The free WPForms Lite has nowhere to review blocked messages, and Contact Form 7 keeps nothing unless a storage plugin such as Flamingo is installed, so on those go easy on filters and test the form often.
3. Add a CAPTCHA if spam continues. WPForms works with reCAPTCHA, hCaptcha and Cloudflare Turnstile, as its guide to preventing spam explains. Each needs a free site key and secret key from the provider, both pasted into the form plugin’s settings (WPForms’ Turnstile guide shows where). Keep the secret key private.
4. Add filters for repeat offenders. WPForms has a keyword filter and a country filter in its Filtering section.
5. Submit a test from a personal address. The routine is in how to add or change a form.
6. Check the spam list weekly for a while. If you find a real customer, reply to them and loosen the setting that caught them.

Expected result: fewer junk entries, and your own test still arrives in your inbox.

The short version

• Start with the honeypot in your form plugin. If spam keeps coming, add Turnstile or reCAPTCHA, not both.
• After every change, fill in the form yourself so real people still get through.

Should I use Turnstile or reCAPTCHA?

Both check whether a visitor is a person, mostly in the background.

	Cloudflare Turnstile	Google reCAPTCHA
What visitors see	Usually nothing; a checkbox only for risky visitors	A checkbox (v2) or nothing (v3)
Needs Cloudflare?	No, it works on any site	No
Privacy note	Runs small checks in the browser	Sets a cookie, per Google’s FAQ

Cloudflare’s Turnstile overview describes how it works without routing your site through Cloudflare. Google’s reCAPTCHA FAQ notes the cookie, which may matter for your privacy policy or cookie notice. Either is fine for most small business forms.

Why does it matter?

Spam buries real leads. When an inbox fills with junk, people stop reading form emails closely, and a genuine enquiry gets missed. Heavy spam can also hurt how inbox providers treat your form’s emails.

What are the common mistakes and edge cases?

• Spam entries don’t send emails. In Gravity Forms, flagged entries don’t send notifications. That’s helpful, but a real lead caught by mistake won’t reach you either. Hence the weekly review.
• Too fast to be human. WPForms has an Enable minimum time to submit setting, on by default. Very quick visitors may see a prompt to wait.
• Human spam. Some spam is typed by real people selling services. No CAPTCHA stops a person. Keyword filters help, and so does deleting without replying.
• Making it hard for customers. Puzzles, math questions and image grids frustrate people and can be harder to use with a screen reader.
• Spam that looks like an attack. Entries with code, strange links or sign-in attempts, or a sudden flood after a quiet spell, may mean your site is being targeted. Make sure plugins are up to date, and see what to do if you think your site was hacked.
• Comment spam is separate. If you don’t use blog comments, they can be turned off. See WordPress comment spam.

What if this didn’t work?

• Spam continues after the honeypot and a CAPTCHA. Check the CAPTCHA actually shows on the live form. A missing or wrong site key can make it fail silently.
• Real customers say the form won’t send. The protection is too strict or broken. Turn off the newest setting and test again.
• Your form plugin has none of these options. Moving to a better-supported form plugin is often the cleanest fix.
• Real leads stopped arriving at the same time. See why form emails go to spam or don’t arrive.

How does E-3 handle this?

Send us the page address of the form and a couple of example spam messages. Forward them, or send screenshots with any personal details covered. People at E-3 make the change, and bigger changes are tested on a staging copy first. Reach us at 814-399-4655 or support@e3help.me.

Related questions

• How do I add or change a form on my website?
• Why are my form emails going to spam or not arriving?
• Why contact forms attract spam (Answers)