Fake submissions are not random noise. Each kind has a purpose, and knowing which one you are receiving tells you what will actually stop it.
"Why would a bot bother filling in my contact form?" is the most common question we get, and the honest answer is that filling in forms is cheap and the sender is not thinking about you specifically. But the traffic is not undifferentiated — there are distinct motives, and they leave distinct traces.
The oldest kind. A message body carrying a URL, submitted at volume in the hope that it ends up somewhere public — a site that publishes enquiries, a poorly configured support desk, an auto-generated page. Mostly pointless now, still enormously common, because the cost of continuing is near zero.
Your form is submitted specifically to see what comes back. An autoresponder confirms the address is live and monitored, which makes it worth more on a list. This is why an immediate, detailed auto-reply to every submission is a liability rather than good service.
Your signup or contact form is used as a relay: someone else's address is entered repeatedly so that your server sends them mail. The victim reports it as spam, and the damage lands on your sender reputation. Volume-based, and the reason rate limiting per target address matters as much as per IP.
Not really about the form at all. The submission is a vehicle for testing what your backend does with unexpected input — oversized fields, injected markup, fields that were never rendered. Server-side validation is the control here, and it is the one class of fake submission that can do real damage rather than waste time.
The expensive kind. Commercial tools work a target list with plausible names, real email domains and templated messages, pacing themselves to look organic. These pass most filters, become leads, get assigned, get called — and they are the reason per-trick defences stop being enough.
Deleting junk from an inbox feels like the whole cost. It is the smallest part.
| Where it lands | What it costs |
|---|---|
| Automations | Every fake submission fires what a real one fires — autoresponders, SMS credits, task creation, notifications — before a human reads it |
| Analytics | Conversions are counted, so cost-per-lead looks better than it is and ad budget optimises toward the wrong traffic |
| CRM | Fake leads get assigned and worked; per-rep numbers and pipeline forecasts drift |
| Deliverability | Bombing and harvested addresses damage sender reputation, pushing real mail to spam folders |
| Attention | Teams learn to skim, and a real enquiry eventually gets deleted with the noise |
Fake submissions that convert are counted as conversions. If a meaningful share of your form fills are automated, then your conversion rate, your cost per lead and your channel comparisons are all measuring a mixture — and the channel that looks cheapest may simply be the one attracting the most bots.
You rarely need forensics. Three signals separate the categories quickly:
For the practical response to each, see how to stop contact form spam, and for the full method comparison, stopping form spam without a CAPTCHA.
Categories one to four are largely solved by hygiene: server-side validation, rate limiting per IP and per target address, a signed timing check, and not sending a detailed autoresponder to unverified addresses.
Category five is the one that needs real detection, because it is designed to look exactly like category zero — a genuine enquiry. Content will not distinguish it, since the content was written to pass. What distinguishes it is how the form was filled in: interaction, cadence, field order, timing.
SpamKill scores that composition rather than the message, at 99.9% accuracy across more than 100M+ submissions screened for 1,500+ businesses — invisibly, with the rare flagged person verifying in one step and continuing, and anything held recoverable rather than deleted. If your problem is categories one to four, the hygiene above may be all you need. From $29/month with a 30-day free trial, no credit card.
Any submission not composed by a person intending to contact you. That covers scripted junk, commercial form-filling tools working a target list, and automated probing of your form as an endpoint. It does not cover a real but unwanted enquiry — cold outreach typed by a human is a different problem with a different fix.
Because targeting is rarely the point. Most automated form traffic works from lists of endpoints harvested at scale, and running a form costs the sender almost nothing. Being small does not make you uninteresting; it just means you were found by a crawler rather than chosen.
Yes, in three places people usually miss. They fire whatever your form triggers — autoresponders, SMS credits, CRM records, sales notifications — before anyone reads them. They corrupt conversion metrics, so ad spend gets optimised toward the wrong traffic. And they train your team to skim the inbox, which is when a real enquiry gets deleted.
Because they were written to. Commercial form-filling tools use name and address dictionaries, real-looking email addresses on real domains, and message text drawn from templates. Judging a submission by whether it reads convincingly stopped being reliable some time ago, which is why content filtering is a weak defence.
A fake lead is what a fake submission becomes once it passes. That is the expensive form: it enters your pipeline, gets assigned, gets called, and skews every per-lead number you report on. Blocking at the form is much cheaper than cleaning the CRM afterwards.
Paste your real form HTML into the Form Transformer and get the protected version back — no signup, no card, nothing to install.
Open the Form Transformer