Quick answer: The best way to stop website form spam is to layer a few light checks rather than rely on one heavy one. Start with a honeypot field and a minimum time check, which stop most automated bots without real visitors noticing. Add a content filter such as Akismet to catch spam that gets through. Use an invisible or score-based CAPTCHA like reCAPTCHA v3 or hCaptcha only if spam is still a problem, and keep a visible challenge as the last resort. Always validate submissions on the server, and add rate limits or firewall rules for heavy attacks.
Why forms attract spam
Any form on a public website will eventually be found by bots. They submit contact forms to post links, test stolen card numbers, deliver phishing messages, or simply probe for weaknesses. Some spam is sent by real people paid to fill in forms, which is harder to block.
Form spam is not just annoying. It buries real enquiries, wastes staff time, can damage your email sender reputation when autoresponders reply to fake addresses, and can fill your CRM with junk.
How to stop it, step by step
1. Add a honeypot field
A honeypot is a hidden form field that real visitors never see or fill in. Bots that fill every field they find will put something in it. If the honeypot has a value, the submission is rejected.
How to do it well:
- Hide the field with CSS, not by setting the input type to hidden, since some bots skip hidden inputs.
- Give it a plausible name, such as “website” or “company_url.”
- Add tabindex=”-1″ and autocomplete=”off” so keyboard users and browser autofill do not land in it.
- Label it for screen readers with a note such as “Leave this field empty.”
Honeypots are free, invisible to visitors and surprisingly effective against basic bots. They do not stop smarter bots or humans.
2. Add a time check
Bots usually submit forms within a second or two of loading the page. People take longer. Record when the form was loaded and reject submissions that arrive too fast, such as under three seconds.
Store the timestamp in a signed or encrypted value so bots cannot simply fake it. Many form plugins include this as an option.
3. Validate on the server
Client-side validation in the browser is for user experience only. Bots skip it. Your server must check every submission:
- Required fields are present.
- Email addresses look valid.
- Field lengths are reasonable.
- Only expected fields are accepted.
- Messages containing many links can be flagged or rejected.
Server-side validation also protects against attacks like SQL injection, so it matters for security as well as spam.
4. Use a content filter
Akismet, made by Automattic, checks submissions against a large database of known spam and flags suspicious ones. It works with comments and with many WordPress form plugins, including Contact Form 7 and Gravity Forms. It is free for personal sites and paid for commercial use.
Content filters catch spam written by humans and smarter bots that pass honeypots and time checks. Review flagged submissions occasionally in case a real enquiry gets caught.
5. Add a CAPTCHA if needed
A CAPTCHA tries to tell humans and bots apart. There are several kinds.
reCAPTCHA v2 checkbox. The familiar “I’m not a robot” box. Sometimes it passes with one click, sometimes it shows image puzzles. It works but adds friction.
reCAPTCHA v2 invisible. No checkbox. It runs in the background when the visitor submits and shows a challenge only if something looks suspicious.
reCAPTCHA v3. Released by Google in 2018, it never shows a challenge. It scores each interaction from 0.0 to 1.0, and you decide what to do with low scores, such as reject, flag for review or ask for more checks. It needs some tuning to pick the right threshold.
hCaptcha. A privacy-focused alternative to reCAPTCHA with similar checkbox and invisible modes. Cloudflare switched from reCAPTCHA to hCaptcha in 2020, which gave it a lot of attention.
Simple math or text questions. “What is 3 plus 4?” These stop very basic bots but are easy to solve programmatically.
The tradeoffs of CAPTCHA
- Friction. Visible challenges annoy people and can reduce form completions. Our article on form abandonment explains why every extra step matters.
- Accessibility. Image puzzles are hard or impossible for some users. Always check that audio alternatives work.
- Privacy. reCAPTCHA loads Google scripts and sends data to Google. If you are subject to GDPR, mention it in your privacy policy and consider whether consent is needed.
- Speed. CAPTCHA scripts add weight. Load them only on pages with forms.
6. Rate limits and firewall rules
For heavy attacks, block the traffic before it reaches your form:
- Limit submissions per IP address over a period of time.
- Block countries you do not serve if spam consistently comes from them.
- Use a web application firewall to filter known bad traffic.
- If you use Cloudflare, firewall rules and bot settings can challenge suspicious traffic on form pages. Our guide to Cloudflare for WordPress covers the setup.
A sensible layered setup
For most business sites, this combination works well:
- Honeypot field
- Minimum time check
- Server-side validation
- Akismet or a similar filter
- reCAPTCHA v3 or invisible hCaptcha only if spam still gets through
- Rate limiting at the server or firewall
Start with the invisible steps. Add visible friction only when you have evidence you need it.
WordPress form plugins
Most popular WordPress form plugins offer built-in spam options:
- Contact Form 7 supports reCAPTCHA v3 and Akismet, with honeypot add-ons available.
- Gravity Forms has a built-in honeypot option, Akismet support and a reCAPTCHA field.
- WPForms, Ninja Forms and Formidable Forms offer honeypots and CAPTCHA options too.
Our comparison of Contact Form 7 vs Gravity Forms and the broader guide to WordPress forms cover the differences in more detail.
Spam on other parts of your site
Forms are not the only target:
- Comments. Turn them off if you do not use them. If you do, use Akismet and require approval for first-time commenters.
- Registrations. Disable open registration unless you need it.
- Checkout. Card testing bots target checkout pages. Payment providers offer fraud tools that help.
- Search. Bots sometimes submit spam search queries to create indexed pages. Make sure search result pages are noindexed.
How to tell if your protection is working
Track the number of submissions per week, the share marked as spam and any complaints from real customers who could not get through. If real enquiries drop after adding a CAPTCHA, the friction may be costing you more than the spam did.
Questions people ask
Is a honeypot enough on its own?
For low-traffic sites it often is. Larger sites usually need a content filter or CAPTCHA as well.
Does reCAPTCHA hurt conversions?
Visible challenges can. Invisible and score-based versions have far less impact, but still need testing.
Why am I still getting spam with reCAPTCHA?
Some spam is sent by humans, and some bots solve challenges. Add a content filter and server-side checks.
Should I block all submissions containing links?
Blocking or flagging messages with several links is reasonable. Blocking all links may stop genuine enquiries.
The takeaway
Stop form spam with light, invisible checks first, then add heavier tools only when the data shows you need them. That keeps your inbox clean without turning away real customers.
If spam and broken forms are costing you leads, see how we can help under Turn visitors into customers.
