Guide
Website Contact Form Flooded With Spam? How to Stop It Without Losing Real Leads
Bots filling your contact form with junk, and real leads getting buried? Here is how to stop form spam with invisible checks instead of annoying puzzles.
Short answer: Use invisible protection: a hidden honeypot field, a time check and a modern challenge like Cloudflare Turnstile, plus filtering on the server. Avoid puzzles that frustrate real customers, and make sure legitimate submissions are saved and reach you.
Why it’s getting worse
Bots crawl the web looking for forms, and AI makes spam read more like a real person wrote it. Forms with no protection get hit constantly.
Layers that work
- Honeypot field: a hidden field people never see but bots fill in.
- Time check: real people take more than a couple of seconds to fill out a form.
- Invisible challenge: Cloudflare Turnstile or similar checks visitors without puzzles.
- Server rules: block links, known spam phrases and repeat senders.
- Rate limits: cap how often one address can submit.
Don’t lose real leads
- Send form notifications from your own domain with proper email authentication, so they don’t land in spam.
- Save every submission in a database or CRM, not just in email.
- Review blocked submissions now and then.
See form spam protection and Cloudflare setup.
Frequently asked questions
Is reCAPTCHA enough?
It helps, but on its own it can annoy visitors and still lets some spam through. Layered, invisible checks work better.
Why do our real form emails go to spam?
Usually because the form sends from an address your domain hasn’t authorized. Fixing SPF, DKIM and DMARC solves it.