How to stop bots from submitting your contact form
Bots are programs that find forms and fill them in automatically. They are fast, tireless and careless, and those three habits are exactly what gives them away.
The short answer
The best way to stop bots from submitting a contact form is to combine checks a person never notices: a hidden field only bots fill in, a minimum time before sending, a one-time token signed by your server, and a limit on messages per visitor. All four must be checked by the code that receives the form, because bots often skip your page entirely.
How bots fill in forms
Most form bots work in one of three ways:
- Simple scripts read your page's HTML, fill in every field and send it. They cannot see which fields are hidden and they send in milliseconds.
- Direct posters never load your page. They send data straight to the file that processes the form, again and again.
- Browser bots drive a real browser. They are slower and can run JavaScript, but still fill forms far faster and more mechanically than people, and at a volume no person could.
A good defence has at least one check that each kind fails.
Four checks that stop automated submissions
1. A hidden trap field (honeypot)
Add a field hidden from people with CSS, labelled for screen readers as "Leave this empty". Simple scripts fill it; people don't. Reject any message where it has a value. More in honeypot vs CAPTCHA.
2. A minimum time
Nobody types a name, an email address and a message in two seconds. Record when the visitor started and reject forms sent faster than about 4 seconds. Browser bots are caught here too, because they rarely wait.
3. A signed one-time token
When the visitor starts filling in the form, your server gives the page a token signed with a secret key, recording when it was issued. The form handler accepts each token once, only if it is genuine, old enough and not too old. Direct posters have no token, and copied tokens only work once.
4. A rate limit
Allow a handful of messages per visitor per ten minutes. Floods stop, and real people are never affected.
Stronger checks for stubborn bots
- A short human action such as slide to send. It takes a person one second and forces a browser bot to simulate a drag.
- Link and content rules: block messages with several links or link markup.
- Silent rejection: answer blocked bots with the same "thank you" a person sees, so their owners cannot tell what failed.
Checklist: is your form protected?
- Does the form handler reject requests that did not start on your page?
- Is there a hidden trap field, checked on the server?
- Are forms sent in under 4 seconds rejected?
- Is there a limit on messages per visitor?
- Can you see what was blocked and why?
If you answered "no" or "I don't know" to any of these, bots can get through. On WordPress, see WordPress form bot protection; for other websites, we can install it for you.
Common questions
Can bots solve CAPTCHAs?
Many can, either with image recognition or by sending the puzzle to people paid to solve it. That is why checks on how the form is filled in matter more than puzzles.
Will blocking bots affect Google?
No. Search engine crawlers read your pages; they do not submit contact forms. Form protection does not change how Google sees your website.
Do bots use JavaScript?
Simple bots do not; browser-based bots do. Use checks that work either way: a time check and a server-signed token catch both.
What is the best way to stop automated contact form submissions?
Several invisible server-side checks together (trap field, time check, one-time token, rate limit), plus a spam log. No single trick stops everything; the combination stops almost all automated spam.