How to stop contact form spam without losing real enquiries.

Start with the checks customers never see

Every spam fix has a cost, and the cost is paid by real customers: the one who gives up on a puzzle, or whose message a filter throws away without telling anyone. So rank the fixes by how many real enquiries they risk, and add them in that order until the spam stops:

• A hidden field that only bots fill in. Customers never see it.
• Checks on the server, where a script cannot skip them.
• A limit on how many messages one connection can send in an hour.
• A review folder for anything caught, so nothing is deleted unseen.
• An invisible check from Cloudflare Turnstile or Google reCAPTCHA, if spam still gets through.
• Never: picture puzzles, lists of banned words, blocked countries or blocked free email addresses.

Take a cleaning company whose form gets dozens of junk messages a week. The office manager deletes them each morning and once deleted a real quote request with them, because it sat between two adverts. The first three fixes above stop most of the junk without the customer noticing anything, and the review folder means the next real request caught by mistake is still there to answer.

Most small business forms never need more than the first four.

Know which kind of spam you have

Read a week of it before you change anything. Spam through forms comes in four kinds, and each needs a different fix:

• Bots that fill in every field they find: random names, links, adverts, text in an alphabet your customers do not use, often at night and many at once. Hidden fields, server checks and limits stop most of these.
• Scripts that send straight to the form's address without loading the page at all. Checks in the visitor's browser never run for them, so only server checks catch them.
• People paid to type sales pitches: search ranking offers, web design offers, app development. They pass every human check because they are human.
• Bots using your form to send email to strangers, through a confirmation email that copies what they typed. This one harms your own email, and it has its own section below.

Note the pattern too. Spam that arrives in bursts from the same few connections points to a limit. Spam that fills a field no customer would fill, such as a long link in the name field, points to server checks.

Add a hidden field that only bots fill in

A honeypot is an extra field in the form that people never see. Bots that fill in every field fill this one too, and the server knows a message with something in it did not come from a person. It costs customers nothing, which is why it goes first.

Built carelessly, it blocks real people. Get these details right:

• Hide it with the page's styling, rather than making it a hidden field type that bots know to skip.
• Keep it out of reach of keyboard users and screen readers, so nobody tabs into it or hears it read out.
• Give it a name that browsers and password managers do not recognise. Autofill can fill a hidden field named like email, phone or address, and then a real customer's enquiry looks like a bot's.
• When it is filled in, show the normal thank-you message and file the message in the review folder. An error message only teaches the bot what to change.

A honeypot stops the simple bots. Better bots skip hidden fields, which is what the next checks are for.

Check on the server, where bots cannot skip it

Anything the form checks only in the visitor's browser can be skipped by a script that sends straight to the server. Put the checks that matter on the server, which handles every message whatever sent it:

• Required fields are present and a sensible length. A name of three hundred characters is not a name.
• The email address has the right shape. If its domain cannot receive mail, ask the visitor to check it instead of rejecting the message, because a typo is more likely than a bot.
• The page was loaded before the form was sent. The page adds a time to the form when it opens, and the server files anything sent within a second or two, or without that time, in the review folder. Keep the minimum short: autofill lets a real customer complete a short form fast.
• Messages with many links go to the review folder. Allow one or two, because customers paste a link to a listing, a photo or a past job.
• The same message sent again within minutes is filed once and flagged.

Treat these as points against a message rather than verdicts. One point, such as a link, delivers the message as normal. Several points together send it to the review folder.

Limit how often one connection can send

A limit on how many messages one internet address can send in an hour stops floods, where a bot sends the form hundreds of times. Set it loosely. An office, a school or a mobile network can put many people behind one address, and two colleagues may both write to you on the same afternoon.

When someone hits the limit, show a plain message rather than failing quietly: "We have received several messages from this connection. Please try again in a few minutes, or call us on the number at the top of this page." A real customer reads it and waits or calls. A bot moves on.

The forms on ggsites.com work this way: short-lived limits kept in memory stop automated abuse, as its privacy notice says, and nobody is asked to solve a puzzle.

Keep caught messages where someone can see them

Filters that delete are how real enquiries get lost. Send every caught message to a separate folder or label, such as "Form: check", with the reason it was caught. Someone skims it once a week, and more often in the first month after a change.

Never let a filter delete form messages without a copy. A spam message in your inbox costs a second to delete. A real enquiry deleted by a filter costs you the customer, and nobody ever finds out.

When a real enquiry turns up in the folder, reply to it the same day and change the rule that caught it. Say a dental practice's filter catches every message with the word "free" in it. Before long, "Is the first consultation free?" turns up in the folder, from a new patient who has had no reply. That rule has to go.

Count two numbers each month: spam that reached the inbox, and real enquiries found in the folder. The first can be above zero. The second should be zero, and if it is not, the filter is too tight.

If spam still gets through, add an invisible check

When the steps above are in place and bots still get through, add a check from a specialist service. Two are common on small business sites:

• Cloudflare Turnstile. Cloudflare's free plan allows up to 20 widgets per account with no limit on the number of checks, and your site does not have to run through Cloudflare. Most visitors see nothing, or one checkbox when the visit looks risky.
• Google reCAPTCHA. The v3 version gives each visit a score without asking the visitor to do anything. The v2 version asks visitors to tick a checkbox and sometimes sets them a challenge. Google has moved reCAPTCHA keys into Google Cloud projects, with a free allowance of 10,000 checks a month and billing above that.

Whichever you use, the result has to be confirmed by your server with the provider for every message. Cloudflare's own documentation says the widget alone does not protect a form, because a script can send anything it likes to your server. A form plugin that shows the widget but never confirms the result is decoration.

Our choice for a small business is Turnstile, because it is free at small business volumes and rarely asks visitors to do anything. Either way, name it in your privacy notice, because both look at the visitor's browser to decide.

The consent question in Europe

European rules on reading or storing information on a visitor's device require consent, with an exception for what is strictly needed to provide the service. Whether a spam check counts as strictly needed is not settled everywhere.

In 2023 the French data protection authority, the CNIL, found that a scooter rental company had broken French rules partly by using reCAPTCHA when people created accounts, logged in or reset a password, without asking for their consent first. Cloudflare says Turnstile processes only the data strictly necessary for its security check and does not read what visitors type into the form.

If you trade in Europe:

• Choose the check that collects the least, and use the hidden field and server checks as your main defence.
• Name the check, its provider and what it looks at in your privacy notice.
• Ask whoever advises you on privacy whether it needs consent where you trade.
• If it does, remember that a check loading only after consent leaves visitors who decline unable to send the form. Keep your phone number and email address on the page for them.

Fixes that cost you real enquiries

These stop spam and customers together. Leave them out:

• Picture puzzles. They are slow on a phone, harder still for anyone with poor sight, and some people give up and call a competitor instead.
• Lists of banned words. Words spammers use, such as free, offer, price or loan, are words customers use too.
• Blocking countries or languages. A hotel that blocks foreign connections blocks its guests, and anyone on a work VPN or travelling looks foreign.
• Blocking free email addresses. Many private customers write from Gmail, Outlook or Yahoo.
• Phone number fields that accept one format only, so a number with a country code or a space fails.
• Asking people to confirm their email address before the enquiry is sent. Some never click the link, and you never hear from them.

If a fix needs a customer to do something extra, it is a last resort, and it needs a review folder behind it.

Stop bots using your form to email strangers

Some forms send the visitor a copy of their message, or offer a box to tick for one. Bots use this to send spam to other people: they type a stranger's address and an advert as the message, and your website emails the advert from your domain, hundreds of times. A host can suspend a site's email when it starts sending spam, and the damage to your domain's reputation reaches your quotes and invoices too.

The fix is simple:

• Remove any option to send the visitor a copy of their message.
• Send the confirmation email only after the message has passed the checks above.
• Write the confirmation as a fixed text that never includes what the visitor typed: "Thanks, your message has reached us. We reply on weekdays, usually the same day."
• Keep the limit on sends per connection, so a flood stops early.

Form emails have their own sending rules as well. A notification that arrives with the customer's address in the From line often goes to spam: see why your business emails go to spam.

Sales pitches typed by people

The messages that offer to fix your search ranking, rebuild your site or sell you a list of leads are typed by people, and no form check can tell them from customers without blocking customers too. Accept that some will arrive.

Deal with them in the inbox instead of the form. A mail rule can label messages with phrases these pitches share, such as "first page of Google" or "I was checking your website", so they sit apart from real enquiries. Do not reply, and mark them as spam in your own mailbox, which teaches your mail provider and does nothing to the form.

If you would rather hear about sales offers, give them their own route, such as an email address on the contact page, so the form stays for customers.

Test it, then check it every month

After any change to the form or its checks, send real test enquiries the way customers do:

• From a phone on mobile data, typing by thumb.
• From a laptop, letting the browser fill in your name and address.
• With a link in the message, such as a link to a photo.
• With a name that has an apostrophe or an accent, such as O'Neill or Zoë.
• From an address at Gmail, which is where many customers write from.

Each one should reach the inbox, not the review folder, with the confirmation email in the customer's inbox too. Then look at the review folder every week for the first month and every month after that.

Every site we build has a form that lands in your inbox, tested from a phone before launch: see websites. Once only real enquiries arrive, the next job is getting each one to the right person quickly, which enquiry follow-up covers. If you are deciding whether a form is the right route at all, see chatbot, live chat or contact form.