Why your contact form fills up with spam, and how to stop it safely

Contact form spam is junk sent through the form on your website, mostly by scripts that look for any form they can post to, and some by people paid to paste sales pitches. It is annoying, rarely dangerous, and easy to cut down. The part nobody warns you about is the fix: a badly set up spam filter throws away real customers and tells nobody.

I've seen both sides of that on sites I build and look after. This guide is for the owner who opens the inbox to "Dear sir, we offer cheap backlinks" for the fortieth time, and wants it gone without losing the one plumber's customer who wrote in at 6 am.

What is the spam coming through my contact form?

Nearly all of it falls into three kinds: bulk ads posted by scripts to thousands of forms at once, sales pitches typed by people, and probes from scanners that test whether your form can be broken into. Each kind needs a different answer, so sort a week of it before you change anything.

The second kind is why no setting gets you to zero. A person sitting in front of a browser is a real visitor as far as any test can tell, and that is exactly how it should be, because your customers are people sitting in front of browsers too. If those pitches bother you, a line on the form saying you don't buy marketing services does more than any plugin. It won't stop them all. It will stop the ones who read.

Is form spam dangerous, or only annoying?

Usually it is only annoying. It becomes a real problem in two cases: when a scanner is probing your form, and when your form sends an automatic reply to whatever email address was typed in, because then strangers get mail from your domain. Both are worth a call to your developer.

The probe case, from August. A restoration company's inbox got several hundred emails in about two minutes, all from its own website, every one stuffed with database test strings like the one in the card above. The main contact and estimate forms were protected and were fine. The flood came through two small forms that had been missed: a request-a-callback button in the corner of every page and a referral form. Nobody had thought of those as forms. The bots had. The cure was the boring one: the same check on every form, not only the ones in the menu.

The auto-reply case is quieter. Plenty of forms send "Thanks, we got your message" to the address in the email field. A bot that types a stranger's address into that field gets your server to email the stranger, as many times as it likes. To mail providers that looks like your domain sending junk, and the next thing that suffers is your ordinary email, the kind I wrote about in why contact form emails land in spam. A form should only send that reply after the visitor passed the bot check.

Which spam protection should my form use?

An invisible bot check that your server verifies on every submission, such as Cloudflare Turnstile or Google reCAPTCHA v3. Both are free at small business volumes and show most visitors nothing at all. A hidden honeypot field can sit behind it as an extra. Tricks that judge typing speed, and blocking whole countries, cost you real customers.

I put Turnstile on every public form I build, with the honeypot behind it as a note, not as a gate. On my own contact form a filled honeypot is written to a log and the message still goes through when the Turnstile check passed. The comment above that line in my code says why: browsers autofill a field named "website", and "website" is the name half the honeypot tutorials tell you to use.

Country blocks get a special mention because hosting panels and plugins make them a single tick box. In September a bot on one of the sites I look after got past the check by going through Tor, a privacy browser. Blocking Tor would have stopped that bot and every real person who uses that browser, so we didn't. The bot's messages had one detail no browser produces, the filter keys on that detail, and the log shows it has caught the bot's messages without catching a single real one.

Why does spam keep coming after I added a captcha?

Most often because the check only runs in the browser and the server never asks Cloudflare or Google whether the visitor passed. Bots skip your page and post straight to the address the form sends to. The other usual reason is a second form, a popup or a callback button, that never got the check.

Cloudflare is blunt about the first one in its own setup guide:

You must call the Siteverify API to complete your Turnstile implementation.

Cloudflare Turnstile docs, server-side validation

In plain English: the little widget on the page hands the visitor a token, and your server has to send that token back to Cloudflare and read the answer before it emails you anything. If that last step is missing, the widget is decoration. The same page says each token lasts 300 seconds and can be checked once, which matters in a minute.

You can't see from the outside whether your server does that step. Your developer can tell you in one sentence, and the two questions for them are at the end of the test below.

Can spam protection block real customers?

Yes, and silently, which is the bad part. The visitor sees an error or a thank-you page, you get nothing, and the inbox looks like a quiet week. Both cases below were on sites I work on, and in both the owner had no idea until somebody went looking in the server logs.

Those two messages are gone. Nobody can tell the owner who those people were or what they wanted. That is the real price of a spam filter nobody tests, and it is why I'd rather read ten backlink offers a week than lose one customer to my own filter. The 300-second token limit from Cloudflare causes a smaller version of the same thing: a visitor who starts typing, answers the phone and comes back ten minutes later is holding an expired token. A good form fetches a fresh one before sending. A careless one shows an error, or worse, a thank-you page.

How do I test my own contact form in ten minutes?

Send yourself real messages through every form on the site, from a phone on mobile data and from a private window on a computer, and check both your inbox and your spam folder. Then ask your developer two questions about what happens to a message that fails the bot check.

1. Make a list of every form: the contact page, the footer, any popup, the quote or booking form, the callback button in the corner. Each one is a separate door, as the restoration company found out.
2. On your phone, with Wi-Fi off, send one message through each. Write which form it was in the message.
3. On a computer, open a private window and do it again. Let your browser autofill your name and email the way a customer's would.
4. Wait ten minutes. Check the inbox the form sends to, and its spam folder. Every message should be there.
5. On one form, start a message, leave the tab for ten minutes, then send it. You want it to arrive, or at least to see a clear error asking you to try again.

The two questions for whoever built the site: "Does the server check the bot token with Cloudflare or Google on every submission?" and "When a submission fails the check, what does the visitor see, and is it logged anywhere?" Good answers are "yes" and "an error asking them to try again, and yes, it's logged". If the answer to the second one is "a thank-you page", a real customer who fails the check thinks they reached you.

If a test message didn't arrive, start with how to capture leads on your website, which covers the parts of a form that break besides the spam check. A form that has to work every day is also part of what I look after in website maintenance and support. And if you'd rather have someone else look the whole site over first, the free website audit takes a minute.

Questions owners ask me about form spam

Sources, read on 14 October 2026: Cloudflare Turnstile, server-side validation for the Siteverify requirement and the 300-second, single-use token; Cloudflare Turnstile, plans for the free plan; Google reCAPTCHA, compare tiers for the 10,000 free checks a month. The cases are from sites I built or look after, between July and October 2026.