Why Your Contact Form Is Full of Spam, and How to Stop It

Contact form spam almost never begins with somebody deciding to target your business. It begins with a bot crawling the web looking for forms, finding yours, and adding it to a list. After that your enquiry inbox fills with guest post pitches, search engine offers, crypto nonsense and plain gibberish, and the one real enquiry you actually wanted is buried somewhere in the middle of it.

Most of it is stoppable. The part worth understanding first is that the strictest possible setting is usually the wrong answer, for a reason most people only discover after it has cost them work.

A Form Is a Public Door, and Bots Knock on Every One

Any form that sends to your server is reachable by anyone on the internet. There is no login, no invitation and no list of approved senders. Software can submit it thousands of times a day without a person ever seeing your website.

Being a small business does not protect you. Neither does being new, being local, or having a site nobody has linked to yet. Bots are not choosing you, they are working through everything they can find.

The Two Kinds of Spam, and Only One Is Easy to Stop

Automated spam is software filling in your fields. It arrives in volume, it repeats the same template, and it usually carries a link. This is the bulk of what you are getting, and it is the kind that technical defences are good at.

Human spam is a real person, often paid very little, typing into your form by hand. It comes in small numbers and it reads like a person, because it is one. No filter catches it reliably, because technically nothing is wrong: a human being is using your form exactly as intended.

That distinction matters because people expect one change to end all of it. Stopping the automated flood is realistic. Ending every unwanted message is not.

What Each Defence Against Contact Form Spam Actually Stops

A honeypot is a hidden field a real visitor never sees and therefore never fills in. Bots fill in everything they find, so anything arriving with that field completed is discarded. It is invisible, it adds no friction at all, and it quietly removes a large share of crude automated traffic. It will not stop a bot written specifically for your site, and it will not stop a human.

reCAPTCHA v3 watches how a submission behaves rather than asking the visitor to solve a puzzle. No traffic lights, no distorted letters. It catches most automated submissions and your customer never knows it ran. One detail gets missed often: if you hide the floating badge, Google requires a short notice near the submit button instead, and that notice is not optional.

Rate limiting caps how many times one address can submit inside a window. It is the right tool for a flood and the wrong tool for a slow drip of one or two a day.

Blocking by country is the blunt one. It works if you genuinely only serve customers in one place. It also blocks your real customer who is overseas on holiday, or on a work VPN, and they will not get an error that tells them why.

The Fixes That Cost More Than They Save

Old style puzzle captchas, the squint at the wobbly letters kind, are worse than useless now. Software solves them more reliably than people do, while real customers give up and anyone using a screen reader is shut out entirely.

Simple sum questions have the same problem in a friendlier jumper. “What is four plus seven” is trivial to automate and still irritating to answer.

Removing the form altogether and posting an email address instead loses every enquiry from someone happy to type into a box but unwilling to open their mail app. The address gets harvested anyway.

Piling on required fields is the quiet one. Every extra compulsory question loses real enquiries, and it barely inconveniences a bot, which fills them all in instantly.

A Form That Blocks Everything Is Worse Than a Bit of Spam

This is what decides how tightly to tune everything above.

Spam is visible. It lands in your inbox, you recognise it in a second, you delete it. Annoying, and cheap.

A blocked enquiry is silent. Nobody gets an error, nothing bounces, no report is generated. The customer submits the form, sees a thank you message, assumes you have it, waits two days and then rings somebody else. You never learn it happened.

The two failure modes are not equal, so do not treat them as though they are. Tune the filters slightly loose, accept that a little gets through, and never crank the thresholds up in frustration after a bad week. A handful of junk messages is the price of being reachable, and it is far smaller than a lost job you never knew about.

How to Tell Yours Is Still Working

Test it yourself, properly. Submit your own form from your phone on mobile data rather than the office wifi, and check it arrives. Check the reply address works too, because an enquiry you cannot answer is no better than one you never received.

Do it again after any change to the site or to your email, because forms break quietly and nothing announces it. Where enquiries land matters as much as whether they were sent, which is why your hosting and email setup is part of the same problem rather than a separate one.

One last signal worth watching: an inbox that suddenly goes completely silent is more worrying than one with a bit of junk in it. Silence usually means something is broken, not that the spam finally stopped.

A honeypot, reCAPTCHA v3 and sensible rate limiting together handle contact form spam for almost every small business, without a single visitor being asked to prove anything. That is the standard we build every website to. If yours is drowning, or you suspect it has gone the other way and quietly stopped delivering, get in touch and we will take a look.