Stopping spam from your website contact form

Almost every website contact form gets spam, because automated programs crawl the web looking for forms to fill in. You can stop most of it with two quiet tools that real customers barely notice: an invisible check such as Cloudflare Turnstile or Google reCAPTCHA, and a hidden "honeypot" field that only robots fill in. Simple filters catch much of the rest. Here is what each tool does, how to tell spam from a real enquiry, and what to avoid so you do not shut out customers along the way.

Why your form gets spam

Spam programs do not know or care what your business is. They visit thousands of sites, find anything that looks like a form, and fill it in with whatever they are selling: search services, website redesigns, loans, dubious pills, or links to scam pages. Some are trying to get a link onto your site; most just hope a person reads the message and clicks.

Spam is also partly done by people, paid to paste the same pitch into forms all day. No tool blocks all of those, because they really are people.

A form that started getting a lot of spam suddenly has not been hacked. It has been found. The fixes below are about making your form harder to use for robots, without making it harder for customers.

The invisible check: Turnstile or reCAPTCHA

The old captcha, with wobbly letters or a grid of traffic lights, stopped robots and annoyed everyone else. Older customers in particular often gave up on it. The newer versions mostly work in the background:

Cloudflare Turnstile checks the visitor's browser quietly and usually shows nothing more than a small box that ticks itself. It is free and does not track visitors for advertising.
Google reCAPTCHA v3 also works in the background and gives each visit a score. Your form decides what score to accept. The v2 version with the "I'm not a robot" box is still common and sometimes asks visitors to pick pictures.
hCaptcha is a similar alternative some builders offer.

Most builders and form plugins have one of these as a setting. On Wix and Squarespace, spam protection is usually built in and turned on by default. On WordPress, most form plugins have a field for Turnstile or reCAPTCHA keys, which you get free from Cloudflare or Google.

The honeypot: a trap only robots fall into

A honeypot is an extra field hidden from people. A visitor never sees it, so never fills it in. Spam programs read the page's code, see a field and fill everything. Any message where the hidden field has something in it gets thrown away.

It costs nothing, it is invisible to customers, and it catches a good share of the simpler robots. Many WordPress form plugins have it as a checkbox, sometimes called "anti-spam honeypot". If your developer builds forms by hand, ask for one.

Simple filters that help

Some spam gets past both tools. A few filters, set on the form or in your email, catch much of it:

Block messages with links. Real customers rarely paste web links into a contact form. Many form tools can reject or flag messages containing "http". If real customers do send links to you, for example to photos, flag rather than reject.
Require a minimum message length, such as a few words. Some robots send one word or a single link.
A time check. Some form tools reject messages sent within two or three seconds of the page opening, which no human can manage.
An email rule. In Gmail or Outlook, create a filter that moves form messages containing typical spam words, like "SEO", "backlinks" or "guest post", into a separate folder. Check it weekly, in case a real customer used one of those words.

What not to do

Do not make customers solve puzzles. A visible captcha with pictures or distorted letters is a last resort. If you must use one, keep the phone number next to the form for anyone who gives up.
Do not block countries or email providers wholesale unless you are sure. A customer using a Yahoo or Hotmail address is still a customer.
Do not ask a "security question" like "what is 3 plus 4". Robots solve them easily now, and they confuse some people.
Do not take the form down. Some owners replace the form with just an email address. That moves the spam to your inbox, where it is harder to filter, and exposes your address to every scraper on the web. A website form vs your email address on the page covers that trade-off.

Spam that looks like a real customer

Some spam is written to look like an enquiry. A few common patterns:

"I tried to reach you but your site has errors" followed by an offer to fix it.
"I noticed your website isn't showing up" from someone selling search services. Read SEO scams owners should ignore before replying to one.
A copyright or legal threat with a link to "see the evidence". Do not click the link. Real legal notices come with a name, an address and no download link.
An overpayment offer: someone wants to book a big job, pay by check for more than the price and ask you to send back the difference. That is a fraud pattern; the FTC describes it on ftc.gov.

When in doubt, do not click links in the message. Reply only through your normal email or call a number you find yourself.

If spam suddenly gets much worse

Turn on, or switch to, Turnstile or reCAPTCHA v3.
Add the honeypot if your form allows it.
Check that the form is not being used to send spam to others. Some badly built forms let a robot put any address in a "send a copy to yourself" box. If your form has that option, turn it off.
Look at your builder or host's security settings for a rate limit on form submissions.

What to do this week

Check whether your form has spam protection on, and which kind.
Turn on an invisible check if it is not there already.
Ask your builder or developer to add a honeypot field.
Set up one email filter for the most common spam words.
Send yourself a real test message afterwards, to make sure customers still get through.

If your form is buried in spam and hard to change, you can see your site rebuilt first with a form that has quiet spam protection already in place, and try it yourself.