If your contact form sends you a stream of junk, don't switch on every protection at once. Read ten of the spam messages first and sort them: fast automated submissions, messages typed by people selling SEO or loans, or messages arriving from a page you thought you'd removed. Each kind needs a different fix, and the fix that stops one kind does nothing against the others. Then add protection in order of how little it costs real customers, and keep what gets caught in a spam folder you check, rather than throwing it away.
Read ten messages and sort them
Open your form's entries list (or the notification emails) and look at the last ten spam messages:
| What you see | Who's sending it | Where to start |
|---|---|---|
| Many submissions minutes or seconds apart, random names, a link in every field | Bots | Honeypot and time check, then a server-checked challenge |
| Readable, polite pitches for SEO, web design, loans, "guest posts", a few a day | People, or bots that pass as people | Content filters and a better form question |
| Spam from a form you thought was gone, or a page that no longer exists | Bots posting straight to an old form address | Remove or disable the old form |
| Junk that started right after an update or a key change | Protection that stopped working | Check the plugin's settings and keys |
Expect a mix. Start with whichever row matches the bulk of it.
Protection, cheapest for real visitors first
1. The form plugin's own honeypot and time check. A honeypot is a hidden field that people never see and simple bots fill in. A time check flags submissions sent faster than a person could type. Both cost real visitors nothing. Check whether your plugin has them as a setting before writing code; Gravity Forms, for example, documents its spam protection as a honeypot with extra checks plus an optional submission speed check. Switch on what it offers before installing anything new.
2. An invisible challenge, checked on your server. Cloudflare Turnstile and Google reCAPTCHA v3 check the visitor in the background. Two details decide whether they work on a contact form:
- The server has to check the token. Cloudflare's Turnstile documentation says plainly that the widget on the page doesn't protect the form by itself: bots can post directly to the form's address, so your site has to verify each token with Cloudflare before accepting the message. Your form plugin does this when it's set up properly. If you added the widget with a snippet or a theme setting and spam keeps coming, this is the first thing to check.
- Tokens expire. Turnstile tokens are valid for five minutes and can be checked only once; Google's reCAPTCHA v3 tokens expire after two minutes. Someone who opens your quote form, goes to measure a window and comes back later can be refused. Test that case before going live: open the form, wait ten minutes, then submit.
3. Content filters. These work against human spam, which no challenge stops. Useful rules for a small business form:
- reject or flag messages with links in the name or phone field;
- flag messages with more than one link in the message field;
- a short list of blocked words from your actual spam ("guest post", "backlinks", "SEO services", "loan");
- a spam-checking service your form plugin connects to, if it offers one.
Gravity Forms' own documentation puts it plainly: no single method catches all spam, and the best results come from using several together. That's realistic for content filters too: they reduce human spam, they don't end it.
4. Rate limits. If a flood comes from a handful of IP addresses, a limit on how often one address can submit the form stops it. That's set at the server, a firewall plugin or a service in front of the site, not in the form. Ask your host what's available on your plan before buying anything.
Ask a question only a customer can answer
The cheapest filter against people pasting sales pitches is a required field that fits your business. A required "Which service do you need?" dropdown with your actual services, or "Which town is the job in?" for a local trade. Someone pasting the same pitch into a thousand forms is likely to leave it blank or answer nonsense, and the answer is useful to you anyway. Don't make it a riddle; a real customer shouldn't have to think about it.
Remove the forms you're not using
Spam "from a page that doesn't exist" means an old form is still accepting submissions. Old landing pages, a second contact form from a previous theme, a form plugin you replaced but never deleted: bots keep the address and post to it directly. Delete or disable forms you don't use, and check the plugin's form list, not just the pages on your menu.
Keep caught spam, and check it weekly
Set the form to mark suspected spam and keep it, not to reject it silently. Gravity Forms, for example, can save flagged entries under a spam filter, where notifications aren't sent. The reason is false positives. Protection can catch real people too: a page served from cache with an out-of-date form, a script conflict after an update, or a filter word that a real customer happens to use. If a real enquiry gets flagged and deleted, nobody ever knows it existed.
A weekly routine takes five minutes:
- Open the spam folder and scan the names and first lines.
- Move any real enquiry to the inbox and reply.
- If a real message was caught, find which rule caught it and loosen that rule.
- Add any new recurring spam phrase to your blocked words.
Test the form after every change
After adding or changing any protection, and after every form plugin update, clear your site's cache and send a test enquiry from your phone on mobile data and from a private browser window. Check that it arrives as a normal message, not in the spam folder. A form that silently blocks real customers is worse than a form that lets some spam through.
If the test enquiry doesn't arrive at all, the problem is delivery, not spam: the guide to missing form emails traces where it stops. And if the junk is newsletter signups rather than enquiries, stopping bot signups covers the list side.