Gibberish in your inbox, every day.
The best way to stop contact form spam is a few invisible filters on your server: a field only bots fill in, a check that the message comes from your own site, a limit on too many messages in a row, and a filter for gibberish. A captcha helps too, but it costs you real enquiries and, in the EU, may need consent under the cookie rules.
We built a form service like that for eleven client domains. Below: what each filter does, how the gibberish filter stopped a spam wave at a client, what you can do today on WordPress or any other site, and when it pays to have it built.
Submit
A visitor or a bot fills in the form
Rate limit
Too many messages in a row are refused
Honeypot
A field people do not see and bots fill in
Origin
Does the message really come from your site
Gibberish filter
Random letter strings in name or message
Sanitise
Make code and links harmless
Your inbox
Only what passed every filter
A blocked message gets a normal reply, so a bot never learns which filter stopped it. The gibberish filter stopped a spam wave at Business Centrum.
Five filters that work
| Filter | What it does | What it stops | What your customer notices |
|---|---|---|---|
| Rate limit | Refuses too many messages in quick succession | Bots sending hundreds of messages | Nothing |
| Honeypot | A field people cannot see but bots fill in | Most simple bots | Nothing |
| Origin check | Checks the message comes from your own site | Bots posting straight to your form endpoint | Nothing |
| Gibberish filter | Recognises random letter strings in name or message | Waves of fake messages | Nothing |
| Sanitising | Makes code and suspicious content harmless | Attempts to attack your site or inbox | Nothing |
The strength: your customer notices none of it. No puzzle, no checkbox, no delay. And a blocked message gets a normal reply, so a bot never learns which filter stopped it.
How we built it
Our form service handles the contact forms of eleven client domains and sends them through Amazon SES to the right inbox. Every form passes the same filters, guarded by 17 tests. The advantage of a shared service: a new filter for one client protects all the others straight away. The filters run on the server, not in the visitor's browser, so a bot cannot get round them by skipping your page.
Questions owners ask us about form spam
Why do I get spam through my contact form?
Bots crawl the web for forms and fill them in automatically, to advertise, plant links or test whether your form can be abused. A form without filters is an open door.
Can I prevent contact form spam without a captcha?
Yes. A honeypot, an origin check, a rate limit and a content filter stop most spam without your visitors noticing anything. Add a captcha only if those fall short.
Is contact form spam dangerous?
Mostly it is a nuisance. But a message with a link to a fake invoice or a login page is phishing. Never click links in messages you did not expect.
How do I stop contact form spam on WordPress?
Add a honeypot, keep form plugins few and updated, and send the form to a separate address. A form service on the server is stronger than a plugin.
How a gibberish filter stopped a spam wave
At Business Centrum, a payroll office in Ghent whose site we built, a wave of messages arrived with random strings of upper- and lower-case letters as name and message. The honeypot alone did not stop them. We read the logs, saw the pattern and wrote a filter that recognises exactly such strings, with the real messages as tests. The wave stopped, and genuine enquiries came through as before. The lesson: spam changes, so a filter you can adjust with real examples is worth more than a fixed setting. See the Business Centrum case.
What a captcha costs you
A captcha asks visitors to prove they are human. It works against simple bots, but there is a price:
- Customers drop offEvery extra step in a form costs enquiries, especially on a phone.
- AccessibilityA visual puzzle is impossible for some visitors. Since the EU accessibility law, that matters for many sites; see the European Accessibility Act and the EU accessibility law one year on.
- Cookies and dataA third-party captcha may store information on your visitor's device or send data to that third party. If that is not strictly necessary, EU rules require consent. At the very least list it in your cookie banner and privacy policy; see do I need a cookie banner.
So start with invisible filters on the server, and add a captcha only if they fall short.
A spam wave, from report to fix
- FirstThe reportThe client receives messages with random letter strings as name and as message.
- ThenReading the logsWhich pattern, what time, from where, and which filters the message already passed.
- NextA new filterA rule on the pattern, tested on the real enquiries so no genuine customer is blocked.
- SinceQuietThe wave stops, genuine enquiries come through as before, and the filter protects every other site on the service at once.
WordPress and other sites
On WordPress, form spam often comes in through a plugin that is no longer updated, or a form without any protection. Keep plugins few and current; see is WordPress safe. On sites we build ourselves, the form is not a plugin but posts to our form service, with the filters on the server.
Ask only for what you need, too. The GDPR requires data minimisation: a name, an email address and a message are usually enough. Fewer fields means less to secure, and a shorter form that more real customers complete. Say in your privacy policy what you do with the data; see do I need a privacy policy.
What it means for your business
| Reader | The risk | What you do |
|---|---|---|
| Company outside the EU with European customers | Spam in languages you do not read, EU rules on captchas | The same server-side filters, a form in each customer's language on a multilingual website |
| Small business or service company | Genuine enquiries drown in spam | Invisible filters, a separate address for the form |
| Online store | Fake orders, phishing aimed at customer service | Filters on every form of your online store, returns and contact forms too |
| Agency | Spam on dozens of client sites at once | One shared form service instead of a plugin per site |
What you can do today
- Add a honeypot field that people do not see.
- Ask only for the fields you really need.
- Send the form to a separate address, not your main inbox.
- Remove form plugins you no longer use and update the rest.
- Never click links in a form message you did not expect.
Protect your inbox as well
A form that mails through your own domain must be set up properly itself: Gmail asks every sender for SPF or DKIM and a low spam rate. Do not let your form send with your personal address as sender; use a fixed sender address on your domain and the visitor as reply-to. If you also send a newsletter, the rules are in how to write a newsletter. If form mail still lands in spam, why are my emails going to spam finds the cause; if your site sends spam itself, it may be hacked, and what to do when your website is hacked covers the first hours.
A form that sells, not only blocks
Stopping spam is half of it. The other half is a form real customers are happy to fill in: few fields, a clear button, a confirmation that says when you will reply. On a landing page the form sits near the top, not after three screens of text. If your site is slow or patched together, read why is WordPress so slow.
How VBS protects your form
From Ghent, Belgium, we design and build websites for businesses across Europe, with the contact form on our own form service: five filters on the server, delivery through Amazon SES, and a filter we adjust as soon as a new wave appears. If your site needs a rebuild, see moving a website to a new host. Book a call.