Contact form spam usually starts small: a few SEO offers a day, then hundreds of messages full of links. The reflex is to add the toughest puzzle you can find. The trouble is that every layer of protection has a cost, and people pay it, not bots. A filter that is too strict rejects genuine enquiries silently, and nobody in the company ever finds out.
This guide arranges protection from layers your customers never see to those that slow them down, and shows how to check that you are not throwing good messages away. Fields, field copy and the confirmation message are covered in a separate guide to contact forms on your website. Here we deal only with what happens to a message between the click on Send and your team's inbox.
Before adding protection, look at what spam you receive
Go through the messages from the past two weeks and sort them into groups. A bot sending hundreds of identical submissions needs a different response from a person pasting a partnership offer by hand. Without this split, you can easily pick a safeguard that stops the smaller part of the problem while adding an obstacle for every customer. Also note how many of those messages were genuine questions, because they set the limit of acceptable risk.
Scroll the table sideways to see all columns.
| Message type | Typical signal | First layer to check |
|---|---|---|
| Bulk bot submission | Every field filled, sent within a fraction of a second | Hidden field and completion time |
| Burst from one source | Dozens of submissions in a short time | Submission limit per IP address |
| Link spam | Several URLs in the text, no actual question | Link filter with quarantine |
| Hand-written sales pitches | Correct text selling services to you | Inbox rule, not a form block |
The last row matters: no technical barrier can tell a hand-written pitch from a customer enquiry. Sorting such messages after they arrive works better than trying to stop them at the form.
Invisible layers: hidden field, timing and IP limit
A honeypot is a field that people cannot see but a simple bot fills in, because it completes everything it finds in the code. Any submission with that field filled goes aside. Hide it so that screen readers and browser autofill skip it too, and give it a name that will not tempt a password manager. Otherwise the trap catches exactly the people you wanted to serve without obstacles.
The second signal is the time between the form loading and the submission. A person needs a moment to read and type, while a bot often sends instantly. The third layer is a limit on submissions from one IP address within a set time window. Leave plenty of headroom: in an office, a school or a mobile network, many people may share the same address.
The W3C note on the inaccessibility of CAPTCHA lists honeypots, heuristics, rate limiting and spam filtering as alternatives or complements to traditional CAPTCHA. It does not state how effective these methods are for any particular website. W3C.
Link and keyword filters: quarantine, not deletion
Customers rarely paste several URLs into a first message, while spammers do it all the time. A rule saying that more than one link means the message needs review removes a large share of junk. The words needs review are the point here. A customer may paste a link to a product they want to order or to the page you are meant to rebuild. The filter should move such messages to a separate folder rather than delete them without a trace.
- Every rejected message goes to quarantine, not the bin.
- Someone reviews the quarantine on a fixed schedule, such as weekly.
- Your blocked word list does not contain the names of your services or products.
- The sender sees the same confirmation whatever the filter decides.
- You record how many genuine messages ended up in quarantine.
That last item is your measure of protection quality. If customer enquiries keep turning up in quarantine, the rule is too strict and needs loosening, not another layer on top.
CAPTCHA: when it makes sense and what it costs
An image or text puzzle stops some bots, but the burden falls mainly on people. A blind person cannot read distorted characters, a deaf person cannot use the audio version, and on a small screen each extra attempt is more discouraging. A customer who fails the test usually does not write to you through another channel; they close the tab. Our guide to accessible contact paths explains how to test the journey with a keyboard and a screen reader.
Background solutions assess visitor behaviour without asking anything. The result is not a verdict: a low-scoring submission can be accepted and flagged for review instead of rejected. Use a visible puzzle only after the invisible layers have failed, and once it is on, compare the number of genuine enquiries before and after the change.
Google's documentation says reCAPTCHA v3 works without user interaction and returns a score from 0.0 to 1.0, with a default threshold of 0.5 that you can tune to your own traffic. It does not say what share of genuine submissions that threshold will reject. Google for Developers.
Check that you are not rejecting real enquiries
Spam dropping to zero is a suspicious result. It may mean your protection works, but it may equally mean the form has stopped accepting anything at all. Every so often, send a submission the way a customer would and follow it all the way through. Repeat the same test after every change to a plugin, theme or filter rule.
- Send an ordinary question.Use a phone, a private window and a mobile connection. Check that it reached the person who should reply.
- Send a question with a link.Add one product URL. See whether the message landed in the inbox or in quarantine.
- Complete the form by keyboard.Tab through every field. Make sure focus never lands on the hidden field.
- Send two submissions in a row.Check that the IP limit does not block someone correcting a typo in their first message.
- Record the result and date.Note what arrived, where and how long it took. Without a record, the next test cannot show what changed.
"Form test on [date], [device]. Please reply to [test email address] and do not add it to the customer database." Wording like this will not confuse the team and is easy to find later.
If the test shows a message got stuck, treat it like any other leak on the path to a conversation. We cover the other places where contacts disappear in our article on where you lose enquiries.
A second contact path and one queue instead of an inbox
Even a well-configured form will occasionally reject someone. That is why it helps to have a channel next to it that is harder for bots and easier for people. Chat requires a conversation, and a website callback request ends in a phone call your team verifies by voice anyway. Our guide to the contact page explains how to arrange these channels on the page.
The second problem is where messages end up. A shared inbox full of spam leaves a real enquiry buried between offers, and nobody knows whether someone has already replied. A queue in which every request has a status and an owner makes it easier to tell a customer's issue from junk. The principles of such a workflow are set out in our guide to ticketing systems in customer service.
In the Meetlead widget, chat, callback requests and the offline form create tickets in one panel queue rather than in separate inboxes. Widget connections and the creation of new visitor records have server-side limits that protect the service from bulk traffic. This is not a spam filter: Meetlead does not assess message content or block contacts, so your team still decides what counts as spam.
Questions about contact form spam
Is a honeypot enough on its own? It stops the simplest automated submissions, but it cannot handle bots that skip hidden fields or people pasting sales offers. Combine it with a timing check and an IP limit. Consider CAPTCHA only when those three layers are not enough, preferably one that runs in the background.
Should you delete messages marked as spam? Not straight away. Keep them in quarantine for a set period and review them regularly, because that is the only way to see false rejections. Delete them after review, in line with the retention period your company has set for form data.
