In this guide · 7 sections
Short answer
Add a honeypot field, then a free bot check like Cloudflare Turnstile or reCAPTCHA that you verify on the server, and limit submissions per visitor. Send yourself a test enquiry every month so you know real leads still arrive.
Why your contact form gets spam
Automated scripts crawl the web looking for forms and post the same message to thousands of sites: SEO offers, crypto links, fake invoices, sometimes phishing links. A smaller share is typed by people who are paid to send sales pitches. The fix depends on which kind you get.
| What you see | Likely source | Best fix |
|---|---|---|
| Gibberish names, links in every field, dozens a day | Simple bots | Honeypot plus server-side checks |
| Normal-looking messages, many in a burst, same text | Smarter bots | Turnstile or reCAPTCHA, verified on the server, plus rate limits |
| Polite sales pitches for SEO or web design | Humans | Filters on keywords, a clear "no sales" line, auto-sorting |
| Messages you never received but visitors say they sent | Your spam filter or email setup | Check the form log and email delivery |
| Hundreds of submissions sending emails to strangers | Form abuse | Stop auto-replies that echo visitor input; treat as a security issue |
That last row matters. If your form sends an automatic confirmation to whatever address is typed in, attackers can use it to send spam through your domain. That can damage your email reputation and get your own mail flagged.
Layer 1: a honeypot field
A honeypot is an extra form field hidden from people with CSS, often labelled something like "Leave this blank". Humans never see it; many bots fill in every field. If the field has a value, your server quietly discards the submission.
- Hide it with CSS, not with type="hidden", which bots know to skip.
- Give it a believable name such as "company_website", and set autocomplete off so browsers do not fill it.
- Add aria-hidden and a tabindex of -1 so screen reader and keyboard users are not tripped up.
- Optionally reject forms submitted within a couple of seconds of the page loading; people do not type that fast.
Most WordPress form plugins, including Contact Form 7 add-ons, WPForms and Gravity Forms, have a honeypot setting. Turn it on first; it is free and invisible.
Layer 2: Cloudflare Turnstile or reCAPTCHA
If a honeypot is not enough, add a bot check. Both of the main options are free for a typical small business site, approximate as of October 2026.
Cloudflare Turnstile
Usually our pickFree (up to 20 widgets)
- Unlimited challenges on the free plan
- Most visitors never see a puzzle
- Cloudflare says it does not access or store form entries
- Works without using Cloudflare for your website
Best for: Most small business contact and quote forms.
Google reCAPTCHA
Free to 10,000 assessments a month
- Now part of Google Cloud Fraud Defense
- Over 10,000 a month needs billing (US$8 flat to 100,000)
- Without billing, requests fail with a quota error after the limit
- Familiar to many plugins
Best for: Sites already set up with a Google Cloud project.
Sources: Turnstile plans and overview, and Google's reCAPTCHA billing page. Note the reCAPTCHA quota failure: if a busy site goes over the free limit without billing set up, the check returns an error. Depending on how your form handles that, it may reject everyone, real customers included.
Privacy note: tell visitors in your privacy policy that a bot-protection service from Cloudflare or Google processes some technical data when they use the form.
Layer 3: server-side validation and rate limits
OWASP's input validation cheat sheet makes the core point: client-side checks in the browser can be bypassed, so validate on the server as well. For a contact form that means:
- Check each field makes sense: a real email format, a phone number of sensible length, a message under a few thousand characters.
- Limit links: most genuine enquiries have zero or one URL. Rejecting or flagging messages with several links stops a lot of spam.
- Rate limit by IP address: for example, a handful of submissions per hour. Cloudflare's rate limiting rules or a plugin can do this.
- Strip HTML from fields before putting them into the notification email.
- Never send an auto-reply that includes the visitor's message to the address they typed in. Send a short fixed text, or nothing.
If spam has suddenly jumped and you also see strange new pages or users on the site, check it has not been compromised. Our guide on what to do if your website is hacked has the first steps.
Don't lose real enquiries: delivery and testing
The quiet danger with spam protection is that real leads disappear and nobody notices for weeks. Two things cause most of it: an over-strict filter, and form notification emails landing in junk.
Keep a copy of every submission
Turn on your form plugin's entry storage, or send submissions to a spreadsheet or CRM as well as email, so nothing depends on one inbox.
Send form emails from your own domain
Notifications should come from an address on your domain via a proper mail service with SPF, DKIM and DMARC set, and use the visitor's address only as Reply-To.
Test from a phone and a different network
Submit a real-looking enquiry from mobile data, not the office Wi-Fi. Confirm it arrives in the inbox, not junk, within a minute or two.
Check the spam or blocked log weekly
Most plugins and Turnstile dashboards show what was blocked. Skim it for genuine customers and loosen any rule that caught one.
Repeat after every plugin or theme update
Updates are when forms most often break. A test enquiry takes one minute.
If enquiries are missing rather than spam being the problem, our guide to contact form emails not arriving goes through the email side. To reply to every real lead quickly once spam is gone, see automating lead follow-up.
Do it yourself or get help?
On WordPress, Wix, Squarespace or Webflow, you can usually turn on a honeypot and Turnstile or reCAPTCHA from the form settings in under an hour. Custom-coded forms need a developer to add the server-side token check.
Contact form spam checklist
If you want it done for you, a Quick Fix (1 hour) at S$119 usually covers adding a honeypot and Turnstile to one form and testing delivery. If spam is a symptom of a wider problem, such as an outdated WordPress site or a form being used to send spam, our Website Security Hardening (S$290) covers the whole site. Our page on website security services in Singapore explains what that includes.
Frequently asked questions
For most small business forms, Turnstile is the simpler choice: it is free for up to 20 widgets with unlimited challenges, rarely shows a puzzle, and Cloudflare says it does not store form entries. reCAPTCHA is also free up to 10,000 assessments a month and suits sites already using Google Cloud. Either must be verified on your server.
It can, which is why invisible or managed checks are better than picture puzzles. Watch your blocked log for genuine names, send yourself a test enquiry each month, and offer another way to reach you, such as an email address or WhatsApp link, for anyone who cannot complete the form.
Common reasons are that the token is not checked on the server, the score threshold is too lenient, or the spam is typed by people rather than bots. Confirm server-side verification first. Then add a honeypot, limit links in messages and set a per-IP rate limit. Human sales spam usually needs keyword filters instead.
Yes, in two ways. Links in spam can be phishing, so staff should not click them. And if the form sends automatic replies containing the visitor's text to any address entered, attackers can use your domain to send spam, which can hurt your email reputation. Send short fixed auto-replies only.
Plain email addresses on a page get harvested and attract spam too, and forms are easier for visitors on mobile. A well-protected form with a honeypot and Turnstile is usually the better option. Many businesses also add a WhatsApp click-to-chat button as a second route.