Guide · Updated October 2026

How Do I Stop Spam on My Website Contact Form?

Practical ways to stop contact form spam: honeypots, invisible CAPTCHA, filters and server checks that block bots without putting off real customers.

Short answer: Most contact form spam comes from automated bots. Combine a hidden honeypot field, an invisible CAPTCHA or challenge, and server-side validation, and you will block the vast majority without making genuine customers solve puzzles. Avoid clunky CAPTCHAs that cost you real enquiries.

Why your form attracts spam

Bots crawl the web looking for forms, then fill them with links to dodgy sites, fake SEO offers or phishing attempts. They do not care who you are. Any public form will be found eventually. Some spam is also sent by humans paid to submit messages by hand, which is harder to block automatically.

The layered approach

No single method stops everything. Layers work best, starting with the ones customers never notice.

1. Honeypot field

Add a field hidden from people with CSS, such as "website". Humans never see it, so they leave it empty. Bots fill in every field. If the honeypot contains anything, the submission is silently discarded. It is simple, free and surprisingly effective against basic bots.

2. Time check

Real people take at least a few seconds to fill in a form. Bots often submit instantly. Rejecting forms submitted in under, say, three seconds catches many of them.

3. Invisible challenges

Modern CAPTCHA alternatives run in the background and score how human a visitor seems, only showing a challenge if something looks suspicious. Several well-known providers offer free tiers for small sites. They are far friendlier than the old "pick all the traffic lights" puzzles.

4. Server-side validation

Check submissions on the server, not just in the browser. Reject messages with invalid email formats, too many links, or forbidden words. Bots can skip browser checks entirely, so server checks matter.

Spam-protected forms come standard. Let SiteDrum handle the bots for you.

SiteDrum builds fast, mobile-first websites from $99 setup and $15 a month, with hosting, security, Google setup and support included. Already have a site that is slow or broken? Try Website Rescue or run our free speed test.

Extra measures for persistent spam

Content filters: anti-spam services can scan the message text and flag likely junk. WordPress has well-known plugins for this.
Link limits: genuine enquiries rarely include URLs. Blocking or flagging messages with more than one link removes a lot of spam.
Rate limiting: limit how many submissions one IP address can send in an hour.
Country or language rules: if you only serve one country and the spam is in a language your customers do not use, filtering on that may help. Use with care so you do not block genuine customers.

What to avoid

Hard visible CAPTCHAs on every form: they frustrate real people, especially on phones and for visitors with disabilities, and can cut genuine enquiries.
Deleting without checking: filters sometimes catch real messages. Glance at the spam folder occasionally.
Publishing your plain email address everywhere: it gets scraped and spammed anyway. Use the form, or obfuscate the address.

Handling spam that does get through

Never click links in spam messages. Some contain phishing or malware. Do not reply either; it confirms your address is active. If someone pretends to be from Google or a domain registrar warning you about your site, check by logging in directly to your accounts, never via the email's link.

When spam signals a bigger problem

A sudden flood of spam is usually just bots discovering your form. But if your site is also sending spam, showing strange pages or redirecting visitors elsewhere, it may have been compromised. That needs a different fix. Our Website Rescue service can check and clean it.

The bottom line

Stop form spam with layers that real customers never see: a honeypot, a time check, an invisible challenge and server-side validation. Add content filters if spam persists. Keep friction away from genuine visitors, because a lost enquiry costs more than a deleted spam message.

Frequently asked questions

What is a honeypot field?

A form field hidden from humans. Bots fill it in, so any submission with that field completed is rejected automatically.

Does CAPTCHA stop all spam?

No. It blocks many bots, but human spammers can still get through. Combine it with honeypots, filters and server checks.

Will anti-spam measures stop real customers contacting me?

Invisible methods like honeypots and background challenges rarely affect real people. Visible puzzle CAPTCHAs are more likely to put people off.

Why am I suddenly getting lots of form spam?

Bots have probably discovered your form. Add layered protection. If your site also behaves strangely, check whether it has been hacked.

Want a website that brings you customers?

Tell us what you do on WhatsApp and we will send a fixed quote and a free mockup.

Get my free mockup

Our products

Starter website$99 setup, $15 a month Business website$249 setup, $29 a month Premium website$499 setup, $59 a month Website RescueFix a slow, broken or hacked site Free speed testCheck your site in seconds Sample websitesSee designs for your industry

Website design near you

Website design in London Website design in New York Website design in Toronto Website design in Geneva Website design in Perth Website design in Gothenburg Website design in Chicago Website design in The Hague Website design in Ottawa Website design in Brighton All cities →

SiteDrum home · All guides · Sitemap · Contact us