How do I stop spam from my website contact form?

Why do contact forms attract spam?

A public contact form allows people to submit information to your website.

That convenience also makes it a target for automated submissions.

Some spam comes from bots.

Other messages may be sent manually.

They may advertise unrelated services, contain suspicious links or attempt to overwhelm the inbox.

A business may also receive irrelevant sales pitches that aren't necessarily automated spam.

The problem is operational.

Employees waste time reviewing messages that aren't legitimate inquiries.

Important customer requests may become harder to notice.

And excessive submissions can create unnecessary system activity.

The goal isn't to prevent every unfamiliar person from contacting you.

It's to reduce abuse while preserving access for genuine customers.

A short form that works is still one of the ways to get more calls from your website.

What is server-side validation?

Validation checks whether submitted information meets expected requirements.

For example, an email field should contain a plausible email address.

A required message field shouldn't be empty.

But validation needs to happen on the server, not only in the visitor's browser.

Server-side validation means the system receiving the submission checks the information before accepting it.

That matters because automated tools may bypass ordinary browser interactions. OWASP's Input Validation Cheat Sheet puts it this way: "Validate on the server even when the browser checks the same fields. Client-side validation is bypassable; use it for immediate feedback."

We'd also limit unnecessary input.

A contact form doesn't need to accept unlimited text or arbitrary files.

Define reasonable requirements based on the business's needs.

But don't make validation so restrictive that legitimate customers cannot describe their situations.

What is a honeypot field?

A honeypot is a form field designed to help identify certain automated submissions.

It may be hidden from ordinary visitors but present in the form's underlying structure.

Some simple bots fill every available field.

If the honeypot is filled, the system may treat the submission as suspicious.

This can reduce basic spam without asking customers to complete an extra challenge.

But it isn't foolproof.

More sophisticated bots may recognize and avoid honeypots.

And implementation needs care to avoid website accessibility problems.

We'd treat honeypots as one layer.

Not as complete protection.

Should you use CAPTCHA?

CAPTCHA systems attempt to distinguish legitimate users from automated activity.

Some require a visible challenge. Google's reCAPTCHA v2 checkbox, for example, "requires the user to click a checkbox indicating the user is not a robot" and may then challenge them to prove they are human.

Others evaluate interactions with less direct user involvement. Google says reCAPTCHA v3 "returns a score for each request without user friction." Cloudflare says its Turnstile tool, which has a free plan, "works without showing visitors a CAPTCHA."

These tools can help reduce certain kinds of spam.

But they can also introduce friction.

A customer may struggle to complete a challenge.

A privacy-conscious visitor may object to additional tracking.

And some accessibility needs may make particular challenges difficult. A W3C note on the inaccessibility of CAPTCHA says the interactive task "inherently excludes many people with disabilities."

We'd avoid adding an intrusive CAPTCHA unless the problem justifies it.

Start with less disruptive protections.

Then evaluate whether additional verification is necessary.

The objective is to protect the form without preventing customers from using it.

What are rate limits?

Rate limiting restricts how frequently requests can be submitted.

For example, a system might prevent repeated submissions from the same source within a short period.

That can reduce automated abuse.

But rate limits require thoughtful configuration.

Several legitimate users may share a network.

And a customer may need to correct an error and resubmit a form.

An overly aggressive limit can block genuine inquiries.

We'd combine rate limiting with other signals rather than rely on one simplistic rule.

Also make sure the system handles blocked submissions appropriately.

Customers shouldn't receive confusing errors when they've done nothing wrong.

Should you block certain words or links?

Content filtering can help identify suspicious messages.

For example, a form might flag submissions containing repeated promotional links.

But keyword blocking can create false positives.

A legitimate customer may use a word that happens to appear in spam.

Or they may include a website address because it's relevant to the service they're requesting.

We'd avoid automatically deleting every message that contains a link.

Consider placing suspicious submissions in a review queue.

That allows employees to recover legitimate inquiries.

The filtering rules should reflect actual spam patterns.

Don't build complicated restrictions based on assumptions.

How do you protect uploaded files?

If your form accepts attachments, take additional precautions.

Limit accepted file types and sizes. OWASP's File Upload Cheat Sheet says to set a file size limit and to allow only "safe and critical extensions for business functionality."

Validate uploads on the server. The same cheat sheet warns that the file type a browser reports "can be spoofed."

Use appropriate storage and security controls.

And avoid automatically executing or trusting uploaded content.

Not every business needs file uploads.

A simple inquiry form may work perfectly well without them.

If customers need to provide photographs, consider how those files will be stored and accessed.

Sensitive information deserves particular care.

Don't request personal data you don't need.

And make sure employees understand how to handle submitted information responsibly.

What should you do when spam continues?

Review the submissions.

Look for patterns.

Are messages arriving in bursts?

Do they contain repeated links?

Are they coming through one particular form?

Then adjust the protections.

You may need better filtering, stronger rate limits or an additional verification layer.

We'd also make sure legitimate inquiries aren't being rejected.

A form that turns real people away is one reason for website traffic but no leads.

Test the form after changes.

Submit realistic messages.

Check whether notifications arrive.

And review the spam folder periodically, as part of regular website maintenance.

At Veshtera, our Launch website package costs $3,500 and includes a contact and quote request form. You get a fixed quote before any work starts.