How to stop contact form spam

Why your contact form gets spam

Every public form on the internet is found by automated scripts that crawl websites looking for anything with a name, email and message field. They fill it in and send it, thousands of times a day across the web. The messages advertise SEO services, loans, crypto and worse, or test whether your form can be used to send email to other people.

A smaller share comes from people paid to paste the same pitch into thousands of forms by hand. Those are harder to stop automatically, but they are usually a minority. If you are getting dozens of junk messages a day, you are almost certainly dealing with bots. Our guide why am I getting so much spam from my contact form explains how to tell the two apart.

The 9 methods, in the order to add them

1. A hidden trap field (honeypot). Add a field that people never see, such as "Leave this empty". Scripts fill in every field they find; a person leaves it blank. Any message with that field filled in is spam.
2. A time check. Record when the form was opened. A real person needs at least a few seconds to type a name, email and message. A form sent in under 3 to 4 seconds was not typed by a person.
3. A signed one-time token. Give each visitor a token signed by your server when they start filling in the form, and accept each token only once. Scripts that post straight to your form handler, without loading the page, have no valid token.
4. Server-side checks. Repeat every check in the code that receives the form. Anything done only in the visitor's browser can be skipped by a script.
5. Link rules. Real enquiries rarely contain more than one web address. Messages with several links, or link markup such as [url= or <a href, are almost always spam.
6. Rate limiting. Limit how many messages one visitor can send in ten minutes. This stops floods and people testing your form.
7. A simple human action. If you want one visible step, make it quick and friendly: slide to send or a single tick box, not distorted letters or picture puzzles.
8. A spam log. Keep a short record of what was blocked and why. When a customer says their message did not arrive, you can check in seconds.
9. Answer blocked bots with a normal "thank you". If the bot sees an error, its owner adjusts it. If it sees success, it learns nothing.

Methods 1 to 6 are invisible to your visitors and stop the vast majority of automated spam. That is why they come first, and why we recommend them before any CAPTCHA.

What not to do

• Don't rely on hiding your email address. It helps against email harvesters, but does nothing for the form itself.
• Don't block whole countries unless you are sure no customer will ever write from there. It often blocks real people travelling or using a VPN.
• Don't delete spam silently without a log. Sooner or later a real enquiry gets caught, and you need to be able to find it.
• Don't answer spam or click its links. It confirms your address is read and some links are malicious.

How to add spam protection to any contact form

How you add these checks depends on how the form is built:

• WordPress: your form plugin (Contact Form 7, WPForms, Elementor, Gravity Forms…) has anti-spam settings and add-ons. See how to stop contact form spam in WordPress.
• A custom PHP or HTML website: the checks go in the file that receives the form (often send.php, contact.php or mail.php). This is where most home-made forms are weakest, because they check nothing at all.
• A hosted form service: use the service's own spam settings, and check whether it keeps a log of what it blocks.

If you would rather not touch the code, a contact form spam protection service can do it for you. It is usually a one-time job of a few hours.

How to check it is working

After adding protection, watch two numbers for a week: the junk that still reaches your inbox (it should drop to almost nothing) and the entries in your spam log (they show the protection is doing its job). Then send a test message yourself from a phone and a computer to make sure real people still get through. If a real test is ever blocked, relax the time check first.