Owner Questions
How to Stop Contact Form Spam Without Annoying Real Customers
Every business with a contact form eventually gets the same messages: offers to 'fix your SEO', crypto pitches, gibberish in five languages, and fake enquiries that read almost like a real customer until the last line links to something you'd never click. A few a week is an annoyance. Dozens a day is a real business problem, because it buries the genuine enquiries and teaches you to skim past your own form messages.
The good news is that most form spam is automated and fairly dumb, and it can be stopped without making real customers solve puzzles. The trick is layering several quiet defences rather than relying on one loud one.
Where the spam comes from
Most of it comes from bots: programs that crawl the web looking for forms, fill in every field, and submit. They don't care what your business does. A smaller share comes from people paid to submit sales pitches by hand, which is harder to filter because, technically, a person is filling in the form.
Knowing which you're getting tells you what will work. Gibberish, links in every field and dozens of messages at three in the morning are bots. Polite, grammatical pitches for marketing services, sent one at a time during business hours, are usually people.
The quiet defences that stop most bots
These work behind the scenes. Real customers never see them.
- A honeypot field. A form field hidden from people but visible to bots, labelled so screen readers skip it too. A human leaves it empty. A bot fills in every field it finds, so any submission with that field filled is discarded. It's simple and surprisingly effective.
- A time check. Real people take at least several seconds to fill in a form. Bots often submit in a fraction of a second. A form that records when the page loaded can reject anything submitted impossibly fast.
- Server-side checks. Many bots skip the page entirely and send data straight to the form's address. Checks that run on the server, not just in the browser, catch those: is the email address valid, is the phone number plausibly a phone number, are there links where there shouldn't be?
- Rate limiting. If the same source submits twenty times in a minute, it isn't a customer. Limiting how often one visitor can submit stops floods without affecting anyone real.
Challenge tools, used carefully
If the quiet defences aren't enough, the next step is a challenge service. The modern ones mostly work invisibly too: Google's reCAPTCHA in its score-based form and Cloudflare's Turnstile both assess whether a visitor behaves like a person and usually let real customers through without any puzzle at all.
Avoid the old-style picture puzzles if you can. Clicking every square with a traffic light frustrates everyone, takes several attempts on a small phone screen, and can be a real barrier for people with poor eyesight or who use assistive technology. In an area like ours, where many customers are retirees, a form that's hard to complete costs you real enquiries. Spam is irritating; lost customers are expensive.
Dealing with the human-sent pitches
No filter stops a person who is paid to fill in your form by hand. You can reduce it, though:
- Ask a question only a customer would answer. A required dropdown like 'What do you need help with?' listing your actual services puts off many pitch-senders, who rarely bother choosing one, and helps you sort real enquiries faster.
- Filter on content. Phrases that only ever appear in pitches ('guest post', 'first page of Google', 'backlinks') can send a message to a separate folder rather than your main inbox. Don't delete automatically; send to review.
- Don't reply. Answering, even to say no, confirms the address is read and invites more.
If you're curious about the cold SEO pitches in particular and whether any of them are worth hearing, we wrote a separate guide to SEO cold calls and emails.
What not to do
- Don't remove the form and publish your email address instead. Bots harvest email addresses from web pages and the spam simply moves to your inbox, where it's harder to filter.
- Don't make every field required. Requiring a full address and a long description for a simple question makes real customers give up long before it bothers a bot.
- Don't filter so hard you lose real messages. Any filter that deletes automatically will eventually delete a customer. Send suspected spam to a folder you glance at weekly.
- Don't assume the spam is harmless. Some form spam contains links to malware or phishing pages. Don't click links in form messages you didn't expect.
Keep spam from poisoning your real email
There's a knock-on effect people miss. If your form forwards hundreds of junk messages to your inbox, your email provider can start to treat everything from your form as junk, including the genuine enquiries. Cutting spam at the form protects delivery of the real messages too. If real enquiries aren't arriving at all, the problem is different, and our guide to forms that don't send covers it.
Newsletter and booking forms need extra care
Contact forms aren't the only target. A newsletter sign-up box can be abused in a way that hurts other people: bots enter real strangers' email addresses into hundreds of sign-up forms at once, burying the victim's inbox so they miss a genuine security alert from their bank. Your form becomes part of the attack, and the complaints that follow can damage your own email reputation.
The fix is double opt-in: the sign-up only counts once the person clicks a confirmation link sent to the address. Real subscribers barely notice the extra step, and nobody can be signed up without their consent. Booking and quote forms deserve the same thought. If a form accepts file uploads, it should only accept the file types you expect, limit their size and never make uploaded files publicly reachable. If it creates bookings, rate limiting stops a bot filling your calendar with fake appointments.
A sensible setup for a small business
For most local businesses, this combination stops nearly all automated spam without anyone noticing it's there: a hidden honeypot field, a time check, server-side validation, rate limiting, and an invisible challenge service as a backstop. Add a 'what do you need help with?' question and a review folder for suspected pitches, and the inbox goes back to being somewhere you want to look.
That's the setup we use, and our custom forms add-on applies the same protections to quote requests and uploads. If your current form is drowning you in junk, tell us and we'll look at what it would take to fix.
ZONA Web Design
Questions about your own site's visibility or speed? We answer every enquiry personally, within one business day.
Talk to the studio