How to stop fake leads from your website
A fake lead costs more than a spam email. Someone has to read it, sometimes call it, and it inflates the figures you use to judge your marketing. When your advertising is paid per click, fake leads also mean paying for traffic that was never a customer.
The short answer
To stop fake leads, block automated submissions with invisible server-side checks (trap field, time check, one-time token, rate limit), reject messages with several links, and record where each real lead came from, so leads from suspicious sources stand out. Keep a spam log so real enquiries are never lost.
Where fake leads come from
- Bots filling in every form they find, often with real-looking names and stolen email addresses.
- Paid spammers pasting sales pitches for SEO, web design or "more leads".
- Fraud on paid ads, where fake clicks come with fake form submissions so they look like conversions.
- Test submissions and duplicates from real people pressing send twice or testing the form.
How to stop them
- Block automated submissions with the four invisible checks in how to stop bots from submitting your contact form. This removes most fake leads at once.
- Reject link-heavy messages. Real customers rarely send more than one link.
- Record the source of every lead: the first page they saw, the search engine or ad that sent them, their country and local time. A lead from a country you don't serve, sent at 3am their time, from a page no customer visits, deserves a second look.
- Stop fake leads from counting as conversions in your analytics and ad platform: count the lead only after it passes your checks, not when the form is sent.
- Keep a spam log so you can check any real lead that was caught.
Lead intelligence: know which leads are real
Protection stops junk. Knowing where each real lead came from tells you which ones to answer first and which marketing works. Useful details to capture with every enquiry:
- How they found you: Google search, a paid ad, a social post or another website.
- The first page they saw and how many pages they read.
- Their country and local time, so you call at a good moment.
- Their device.
Ask visitors' permission before keeping this in their browser, and mention it in your privacy policy. Our form protection records these details with every real enquiry.
Common questions
Why do fake leads use real names and emails?
Bots use lists of stolen or generated identities so the leads look genuine. That is why checks on how the form was filled in work better than checking the name or email.
Can I stop fake leads from Google Ads?
Protecting your form stops fake form submissions from counting as conversions, which keeps your ad platform from optimising for fake traffic. Report suspicious click patterns to the ad platform as well.
Should I verify every lead's email?
A confirmation email with a link is a good filter for high-value forms, but it adds a step for real customers. For most businesses, blocking bots first is enough.