How to stop contact form spam

Contact form spam is the most common form of the problem because contact forms are the most common form. They are public, they are usually the oldest form on the site, and they almost always post to a human inbox — which means every junk submission costs someone attention rather than just database rows.

This is the applied version of our guide to stopping form spam without a CAPTCHA. That one explains the methods; this one tells you what to do first.

First, work out what you are actually facing

The fix depends on the source, and there are three quite different ones. Spending ten minutes here saves you implementing the wrong thing.

The ten-minute changes

Do these regardless of what else you decide. None of them touch your visitors.

• Validate on the server. Enforce lengths, types and allowed characters, and reject any submission carrying fields your form never rendered. Browser validation is a convenience, not a control.
• Add a signed timing check. Record when the form rendered, reject implausibly fast submissions. Sign the timestamp — a plain hidden field with the render time is trivially rewritten.
• Rate limit per IP and per target address over a rolling window. This is what stops the overnight blast that fills your inbox with four hundred messages.
• Add a properly hidden honeypot field. Not type="hidden", not name="honeypot", and hidden from assistive technology too with aria-hidden="true" and tabindex="-1" so a screen reader user does not fill it in and get silently rejected. See honeypot vs CAPTCHA for how far this gets you.

For a lot of small sites, that is the end of the story. Measure for a fortnight before doing anything more.

The changes that feel productive and are not

Rewriting your field names. It breaks scripts hard-coded to your old markup, so volume drops for a few weeks and then returns. Free to try, but do not mistake the dip for a fix.

Removing the form and publishing an email address. This moves the filtering into your inbox and throws away every signal a form gives you, while losing the enquiries from people who will not open a mail client.

Long keyword blocklists. Spam text mutates faster than you can maintain rules, and the false positives are expensive — a real prospect writing about "SEO services" should not be binned. Keep a short list for the human-written spam and review what it catches.

Adding a CAPTCHA on top of protection you already have. Two form gates give you the friction of one and the accuracy of neither, because each sees only part of the submission and real people still get stopped by the weaker one. Network -level protection at your CDN is a different layer and is fine to keep running.

When the ten-minute changes are not enough

If junk is still arriving after timing checks, rate limits and a honeypot, you are no longer facing opportunistic traffic. Commercial form-filling tools render your page, execute your JavaScript, skip fields that look like traps and pace themselves under your rate limits. Nothing on a per-trick list beats them for long, because each trick is a single rule that can be read and routed around.

That is the point to move to behavioural detection: scoring how the submission was composed — interaction, cadence, field order, timing — rather than testing one property of it. There are many signals, they update as automation changes, and a bot has to defeat all of them at once.

Measure it properly

Whatever you implement, track blocked versus passed as a ratio over time, and watch the conversion rate on the form itself. A filter that quietly rejects real enquiries looks identical to a filter that works — right up until a customer tells you they tried to reach you three times. If you cannot inspect what you rejected, you cannot know your false-positive rate.

Frequently asked questions

Why did my contact form suddenly start getting spam?

Almost always because it was discovered, not because anything changed on your side. Automated crawlers index forms continuously, and once an address or endpoint lands on a list it gets retried for months. A redesign that changed your field names can also reset a filter that was quietly working.

Will changing my form field names stop the spam?

Briefly, sometimes. Renaming fields breaks scripts hard-coded to your old markup, so volume can drop for a few weeks. It is not a fix — generic form-fillers read the rendered form and adapt — but it costs nothing and it does tell you something useful: if renaming helps a lot, you are facing cheap automation rather than anything targeted.

Should I just remove my contact form and publish an email address?

It moves the problem rather than solving it. A published address gets harvested and then you are filtering in your inbox instead, without any of the signals a form gives you. It also costs you the genuine enquiries from people who will fill in a form but will not open a mail client.

Is it worth blocking whole countries?

Only if you genuinely do no business there, and even then treat it as a blunt instrument. Geographic blocking stops a share of automated traffic cheaply, but it also silently turns away travelling customers and anyone on a VPN. Use it to reduce noise, never as your only defence.

How much contact form spam is normal?

There is no useful benchmark — it depends entirely on your traffic, how long the form has existed, and whether your address is on a list. The number that matters is the ratio of blocked to passed submissions and whether it is trending in the right direction after a change.