.png&w=3840&q=75)
Websites & Hosting4 min
How to Stop Spam Submissions on Your Website Contact Forms
NS
NameSilo Staff7/17/2026
Share
To stop spam submissions on your website contact forms, implement an invisible verification layer like Google reCAPTCHA v3 to mathematically score and block automated bots. For a frictionless user experience, use the Honeypot method: add a hidden form field that humans cannot see, but bots will automatically fill out. If the hidden field is filled, the server silently rejects the spam submission.
How Bots Find and Exploit Your Forms
Automated crawlers scan the web for <form> tags with a method="POST" attribute. Once found, a script fills every visible input field with junk data (fake names, spam links, crypto pitches) and submits repeatedly, sometimes hundreds of times per day, without any human involvement.
Most spam bots are unsophisticated. They fill every field they detect in the HTML, including fields deliberately hidden from human view. This blind, indiscriminate behavior is exactly what makes them easy to trap.
Why It Matters: Bandwidth and Reputation
Unchecked form spam causes two real problems beyond a cluttered inbox:
- Server load: Hundreds of daily submissions consume processing time and bandwidth, especially on shared hosting.
- Sender reputation risk: If your form auto-forwards submissions via email and a bot injects malicious content, your domain's sending reputation can suffer, affecting deliverability for legitimate business email too.
Filtering spam at the form level protects both your inbox and your domain's standing with mail providers.
Solution 1: Score-Based Verification (reCAPTCHA v3 vs v2)
Version | User Experience | How It Works |
v2 Checkbox | Visible "I'm not a robot" click, sometimes image puzzles | Binary pass/fail challenge |
v3 Invisible | No user interaction at all | Returns a 0.0-1.0 risk score you interpret server-side |
v2 actively hurts conversions. Forcing a customer to click boxes identifying fire hydrants adds friction that measurably increases form abandonment, particularly on mobile.
v3 is the better choice for most sites. It runs silently in the background and returns a score; you decide the threshold for what counts as suspicious.
2026 update: Google migrated reCAPTCHA into Google Cloud in 2025. The free tier now caps at 10,000 assessments per month per project, billed beyond that. For fully free, unlimited, invisible protection with less GDPR overhead, Cloudflare Turnstile has become a widely adopted alternative that functions similarly to v3 without the usage cap.
Solution 2: The Honeypot Technique
A honeypot is a form field hidden from human view using CSS, but left fully visible in the raw HTML that bots read.
<input type="text" name="website" style="display:none" tabindex="-1" autocomplete="off">
Real visitors never see or fill this field. Bots filling every field they detect fill it automatically. On your server, check: if that field contains any value, silently discard the submission instead of processing it.
This requires no third-party service, no JavaScript library, and adds zero friction for real users. It catches the large majority of unsophisticated bot traffic on its own.
Common Mistakes
Using outdated distorted-text CAPTCHAs: Old warped letter puzzles are difficult for elderly users and effectively inaccessible for visually impaired customers using screen readers. Many genuine visitors abandon the form rather than struggle through one, costing you real leads to save yourself from bot spam.
Relying on a single method: Honeypots alone won't stop a targeted human spammer manually filling out your form. Layering a honeypot with invisible score-based verification covers both casual bots and deliberate abuse.
Forgetting server-side validation: A honeypot or CAPTCHA only works if your backend actually checks it before processing. A frontend-only check does nothing against bots that skip JavaScript entirely.
What This Means for You
Keeping spam out of your contact form protects the sending reputation tied to your NameSilo Email address. If you're building or editing your form directly, NameSilo Hosting gives you full file access to implement honeypot fields and server-side checks.
Frequently Asked Questions
Why am I getting so much spam from my contact form?
Automated bots scan for and submit to unprotected POST forms at scale.
How do I add reCAPTCHA to WordPress?
Install a security plugin or use a form plugin with built-in reCAPTCHA support.
What is a honeypot field?
A hidden form field invisible to humans that traps bots filling every field.
Is Google reCAPTCHA free?
Yes, up to 10,000 assessments per month; usage beyond that is billed.
How do bots fill out forms?
Scripts detect form fields in HTML and submit junk data automatically.
Can I block IP addresses from submitting forms?
Yes, but bots rotate IPs constantly, making this a weak standalone defense.
Does Cloudflare stop form spam?
Yes. Cloudflare Turnstile provides free, invisible bot verification.
How do I secure my website emails at NameSilo?
Combine form-level honeypots with SPF, DKIM, and DMARC on your domain.
.png&w=2048&q=75)
NameSilo StaffThe NameSilo staff of writers worked together on this post. It was a combination of efforts from our passionate writers that produce content to educate and provide insights for all our readers.
More articleswritten by NameSilo
.png&w=3840&q=75)
.png&w=3840&q=75)
.png&w=3840&q=75)