How Do I Stop Spam From My Website Contact Form?

Spam is annoying, but the real damage is that you start ignoring form notifications — and then miss a genuine inquiry sitting between two junk ones.

Quiet measures that work first

• •A honeypot: a hidden field real people never see and bots fill in. Submissions with it filled get dropped.
• •A timing check: a form completed in under a second wasn't completed by a human.
• •Rate limiting: a cap on how many submissions come from the same source in a short window.
• •Server-side validation: check the fields on the server, not just in the browser.
• •Blocking obvious junk patterns, like messages that are only links.

These cost your customers nothing, which is why they come first.

When to add a visible bot check

If spam continues, a modern bot check is reasonable — the kind that's usually invisible and only challenges suspicious visitors. Avoid the old puzzle-style tests. Every extra hoop loses real inquiries, and hard image or audio puzzles are a genuine accessibility problem. See what makes accessibility matter.

Don't lose real leads while fighting spam

• •Store every submission somewhere, not just in email, so filters can't hide one.
• •Check your spam folder for form notifications weekly.
• •Test your own form after any change to it.
• •Keep the form short — long forms don't reduce spam, just responses.

See why isn't my contact form getting submissions and what happens after someone submits.

If you're getting sales pitches, not bots

Plenty of "spam" is humans pitching SEO and web design services. Technical filters won't stop that. An email rule that files messages containing the usual pitch phrases keeps your inbox usable without touching the form.

What it depends on

The options available depend on your platform, your form tool, and your hosting. Ask what protections your form already has before adding anything — many have a honeypot and rate limiting already.