How to stop contact form spam in WordPress
WordPress runs a large share of the web, so bots know its forms well. The good news: every major form plugin has anti-spam features. Most WordPress spam comes from features that were never switched on.
The short answer
To stop contact form spam in WordPress: update your form plugin, switch on its honeypot and anti-spam token, add Cloudflare Turnstile or reCAPTCHA v3 if spam continues, block messages with several links, keep entries of blocked messages, and remove old unused forms. Keep WordPress, the theme and plugins updated so the form itself stays secure.
Step by step
- Update everything. WordPress, your theme and your form plugin. Old form plugins are a common way into WordPress websites.
- Find every form. Contact page, footer, pop-ups, landing pages and old pages you forgot. Bots find all of them.
- Switch on the plugin's built-in protection: a honeypot field and any anti-spam token or time check it offers.
- Add a CAPTCHA-type service only if needed: Cloudflare Turnstile (usually invisible) or reCAPTCHA v3. Enter the keys in the plugin's settings and test.
- Block link-heavy messages using the plugin's content rules or WordPress's "Disallowed Comment Keys" list where your plugin supports it.
- Keep entries (or a log) so you can find real messages that were caught.
- Stop fake leads counting as conversions in analytics: track the thank-you page only after a successful, checked submission.
Plugin-specific guides
WordPress contact form security
- Remove form plugins you no longer use.
- Don't let forms accept file types you don't need.
- Send email through an authenticated SMTP or email service from your own domain, not PHP's default mail.
- Limit who can edit forms in the WordPress admin.
- Back up regularly, including form entries if they hold customer data.
More in our contact form security checklist.
When plugin settings aren't enough
Some spam still gets through plugin protection: bots that post straight to WordPress's form endpoints, or floods that overwhelm free CAPTCHA limits. At that point, server-side protection in front of the form (a signed token, time check and rate limit on the server) closes the gap. We install this for WordPress sites and keep your existing form and design.
Common questions
What is the best anti-spam plugin for WordPress contact forms?
It depends on your form plugin. Start with its own honeypot and token, then add Turnstile. See our WordPress comparison.
Does Akismet stop contact form spam?
Akismet filters by content and works with several form plugins. It helps with human spam, sends messages to Automattic for checking, and needs a paid plan for commercial websites.
Why do I get spam even with reCAPTCHA on WordPress?
Either the spam is sent by people, or bots are posting to an endpoint the CAPTCHA doesn't protect. Check your spam log and your plugin's settings for server-side verification.