Why am I getting so much spam from my contact form?
A sudden flood of junk through your contact form is not a sign that you did something wrong. It means your form has been found, and it has no protection that stops automated scripts.
The short answer
You get contact form spam because bots crawl the web for forms and fill in every one they find, and a form with no server-side checks accepts all of them. Spam usually jumps once your website is listed in search engines or a spam list. A hidden trap field, a time check and a one-time token stop most of it.
The five most common reasons
- Your form has no protection that runs on the server. Many forms, especially home-made ones, only check that the email looks valid. Everything else gets through.
- Your form is on a spam list. Once one bot finds a form that accepts messages, the address is shared and sold. That is why spam often goes from a few a week to dozens a day almost overnight.
- Bots post straight to your form handler. If the file that receives the form accepts anything sent to it, bots do not even need to load your page. A CAPTCHA shown on the page does nothing against this.
- Your website ranks for business terms. Agencies selling SEO, web design and leads target websites that look like businesses. Much "spam" is a sales pitch pasted by people, not bots.
- Your form sends a copy to the sender. Spammers love forms that email a copy to "the sender", because they can put someone else's address in the email field and use your website to send their advertising.
How to detect spam contact form submissions
These signs, especially together, mark a message as automated spam:
- Several links in the message, or link markup such as
[url=. - A name that is random letters, or the same word repeated in several fields.
- The same message arriving many times with small changes.
- Messages arriving at night in your time zone, in bursts.
- A message unrelated to your business (crypto, loans, pharmacy, adult content).
- In your server logs: the form was sent without the page being loaded first, or within one or two seconds of it.
Paid human spammers look different: the message is readable, usually a pitch for SEO, web design, leads or financing, sent from a real-looking email address. Invisible checks do not stop them, because they fill in the form like anyone else; a link rule and a keyword list help.
Bots or people? Why it matters
| Sign | Bots | Paid people |
|---|---|---|
| Volume | Dozens to thousands | A few a week |
| Speed | Seconds | Like a normal person |
| Message | Links, nonsense, repeats | Readable sales pitch |
| What stops it | Trap field, time check, token, rate limit | Link rules, keyword rules, a blocklist |
If most of your spam is automated, invisible protection solves the problem. See how to stop contact form spam for the full list of methods.
What to do today
- Turn off "send a copy to the sender" if your form has it, or make sure the copy never repeats what the visitor typed.
- Add a hidden trap field and a time check. On WordPress, your form plugin has settings for this.
- Make sure the file that receives the form checks everything itself.
- Keep a spam log for a week, so you can see what is being blocked and why.
If you are receiving hundreds of messages, start with our emergency guide: how to stop thousands of spam form submissions.
Common questions
Did someone target my website on purpose?
Almost never. Spam bots attack every form they find automatically. It feels personal, but your website is one of millions on the same list.
Can contact form spam hurt my website?
Yes. Beyond wasting time, a form that sends emails can be used to send spam in your name, which can get your domain's email blocked. Some spam also contains malicious links or tries to inject code.
Why did spam start suddenly?
Usually because your form was added to a list that bots share, often soon after your website started ranking in search engines. Once listed, the volume stays high until the form blocks the bots.