Web · 5 min read · October 2026
Stopping form spam without losing customers
A contact form starts receiving enquiries in Russian, offers for SEO services, links to strange websites and messages that make no sense. Soon there are dozens a day, and real enquiries get lost among them, or someone gets tired of checking. The instinct is to add a difficult CAPTCHA. That often blocks real customers too.
Here is why forms attract spam, the layers of protection that stop most of it quietly, and how to make sure real customers still get through easily.
01
Why forms get spam
Automated bots scan the web for forms and submit them, hoping to post links, test stolen details or advertise. They do not care what your business is. Any public form will eventually be found. Some spam is also sent manually by people selling services, which is harder to stop automatically.
Spam usually grows over time once a form has been found, and sudden spikes often follow a site being listed somewhere new. It does not mean your site has been hacked, but it is worth dealing with before it buries the real enquiries.
02
Layer 1: a honeypot field
A honeypot is a hidden field that real visitors never see or fill in, but many bots do, because they fill every field. If it is filled, the submission is discarded. It is invisible to customers and stops a surprising amount of basic spam. Many form plugins include it as an option.
03
Layer 2: invisible bot checks
Modern bot protection, such as invisible CAPTCHA services, checks behaviour in the background and only challenges visitors who look suspicious. Real customers usually never see a puzzle. These are much better than the old distorted-text CAPTCHAs, which frustrate people, especially on phones.
Avoid challenges that are hard on mobile or for people with visual impairments. Every extra step loses some real customers.
04
Layer 3: filtering
Spam filtering services and plugins check message content against known spam patterns and block or flag submissions. Simple rules help too: rejecting messages with many links, or with certain words that never appear in your genuine enquiries. Review flagged messages occasionally, in case a real enquiry was caught.
05
Layer 4: time and rate limits
Bots often submit forms instantly, faster than any human could type. Rejecting submissions sent within a couple of seconds of the page loading, and limiting how many submissions come from one source in a short time, stops much automated spam.
06
Keep real enquiries flowing
After adding any protection, test the form yourself from a phone and from a different network. Ask a friend to submit an enquiry. Check that genuine messages arrive and are not in your spam folder. Make sure there is always an alternative, such as a WhatsApp button or phone number, so a blocked customer can still reach you.
07
Email deliverability
Sometimes the problem is the opposite: real form submissions landing in your spam folder. Setting the form to send from an address on your own domain, with correct SPF and DKIM records, or using a proper email-sending service, makes delivery more reliable. Test monthly.
08
When the spam is manual
Some unwanted messages come from real people, usually selling SEO, app development or marketing services. No filter stops all of them without risking real enquiries. A simple approach is a line above the form saying it is for customer enquiries only, and a filter that flags messages mentioning common sales phrases for review rather than deleting them. Never reply to them from your main inbox; it confirms the address is active.
Protect quietly
The best spam protection is invisible to real customers. Honeypots, background bot checks and filtering together stop most junk without asking anyone to click on traffic lights. Visible puzzles should be the last resort, not the first.
Stop the bots, not the customers.
If spam is still getting through after these layers, look at whether it is automated or manual, and adjust. Manual spam is better handled with filters and rules than with harder puzzles.
Form spam checklist
- Honeypot. A hidden field that bots fill and people do not.
- Invisible bot check. Challenges only suspicious visitors.
- Filtering. Content checks and simple rules.
- Limits. Reject instant and repeated submissions.
- Testing. Real enquiries still arrive, every month.
Most small business sites need only the first three. Together they usually reduce spam from dozens a day to almost none.
Quick answers
Why is my website contact form getting spam?
Automated bots find public forms and submit them to post links or advertise. Any public form will eventually be targeted.
What is the best way to stop form spam?
Combine a hidden honeypot field, an invisible bot-check service and content filtering. These stop most spam without making real visitors solve puzzles.
Will a CAPTCHA stop real customers?
Difficult visible CAPTCHAs can frustrate and block some real customers, especially on phones. Invisible checks that only challenge suspicious visitors are a better choice.
Related reading
Real enquiries in, junk out.
Every website I build has forms protected by honeypots, invisible checks and filtering, tested so genuine enquiries arrive reliably. Send me your site if spam is burying your leads.