Spam Through Your Contact Form: 6 Ways to Stop It Without Annoying Visitors

Most contact form spam comes from bots that fill in forms automatically, and most of it can be stopped without adding a single extra step for visitors. The most effective and least intrusive pair: a hidden trap field (honeypot) that people don't see but bots fill in, and a timing check that rejects forms submitted in under a few seconds. If those aren't enough, add a per-IP submission limit and an invisible check such as Cloudflare Turnstile or reCAPTCHA. Old-style challenges that make visitors pick traffic lights also reduce real enquiries.

Spam isn't just annoying. When the inbox fills up, real enquiries get missed, and a form that sends replies to spam can damage your site's email reputation.

Know where the spam comes from

Unwanted form messages usually come in three kinds:

• Bot spam. Meaningless messages in foreign languages, full of links. They arrive within seconds, at all hours. This is most of the problem.
• Sales pitches. Messages like 'let us do your SEO' or 'we'll get you to the top of Google'. Most are sent by people or semi-automatically; technical measures won't stop them completely.
• Malicious probes. Code snippets entered into the form to look for vulnerabilities. That's more a security issue than spam.

The measures below go from easiest to hardest. For most sites, the first two solve most of the problem.

1. A hidden trap field (honeypot)

A field hidden with CSS is added to the form. Human visitors don't see it and leave it empty. Bots tend to fill in every field. If the field is filled, the message is quietly discarded.

It costs visitors nothing and stops most simple bots. On WordPress, many form plugins offer it in their settings as 'honeypot' or 'anti-spam'; Contact Form 7 has a separate honeypot plugin. On custom-coded sites it's a few lines of work.

2. A timing check

A real person needs at least a few seconds to open a form and type a name, phone number and message. Bots submit as soon as the page loads. Sending the page's load time along with the form and rejecting messages sent in, say, under 3 seconds is a second strong filter. It's invisible to visitors too.

3. A per-IP submission limit

Blocking many submissions from the same IP address in a short time stops a bot from filling in your form hundreds of times an hour. Allowing no more than 5 submissions in 10 minutes, for example, never affects a real visitor. Form submissions on Kodyva's own site also pass through a per-IP rate limit. On WordPress, some security plugins apply this limit to form submissions too; if you use Cloudflare, you can write a rate-limiting rule for the form's address.

4. Invisible verification: Turnstile and reCAPTCHA

If the first three measures aren't enough, add a verification service that assesses in the background whether the visitor is a bot.

Cloudflare Turnstile works for most visitors without asking them anything, and it's lightweight. Google reCAPTCHA v3 is invisible too; it scores each submission and lets you reject low scores. Both integrate with most form plugins.

KVKK note: these services collect data from the visitor's browser and send it to their own servers (abroad). If you use them, you need to mention them in your privacy and cookie texts. We explain the form and KVKK relationship in detail in is a KVKK consent checkbox required on a contact form. That's why we suggest trying the first three measures first; on most small business sites, no external service is needed.

Avoid old-style challenges that make visitors select images or type blurry letters. They're especially annoying on mobile and increase the number of real customers who abandon the form.

5. Content filters

Bot messages share features: many links, certain words, an alphabet different from your site's language. Simple rules work:

• Flag or reject messages with more than two links.
• Block letters in the phone field and links in the name field.
• On a site serving Turkish customers, route messages written entirely in a different alphabet to a separate folder.

On WordPress, services like Akismet compare messages against known spam patterns. They also send message content to an external server; the same KVKK note applies.

Setting filters to mark messages as 'suspicious' instead of rejecting them is safer. If a real customer's message is caught by mistake, you'll find it in the suspicious folder instead of losing it.

6. Don't publish your email address in plain text

Email addresses written as plain text on the site are easily harvested by bots, and part of your spam arrives not through the form but straight to that address. Make the form your main contact route; if you need to show the address, place it as a clickable link in a way bots find harder to read. We explain how to design a form that brings in more enquiries in contact form design.

Less spam, but fewer real enquiries too?

Test the form yourself after each measure: from a phone, from another browser, filling it in quickly. A drop in real enquiries may mean the filters are too strict. Form messages not arriving at all is a different problem; run the checks in contact form emails not arriving.

A surge in spam is sometimes a sign that the site itself has been compromised: if spam is being sent from your site rather than through the form, your host will warn you. In that case, look at the website security measures list.

Form security and regular testing can run alongside the routine checks in maintenance and support. If your form is drowning in spam and you're not sure which measure suits you, write to us.