Contact form spam is annoying, but the expensive mistake is the cure. Every filter has a false-positive rate, and on an enquiry form a false positive is a customer who thinks you ignored them.
So the goal is not zero spam. It is a defence that stops the bulk while never rejecting a person.
Layers, not a wall
Effective spam handling stacks cheap checks that each catch a different kind of sender, rather than relying on one aggressive gate.
- A honeypot field, hidden from people and filled in by naive bots. Invisible, frictionless, and it catches a surprising share.
- Rate limiting per address, so one source cannot submit fifty times.
- A challenge, but only on the endpoints where it is safe to fail closed.
- Server-side validation, because anything enforced only in the browser is not enforced.
The messages themselves land in the site inbox described in understanding notifications.
That is roughly how the forms here are protected: lead-generation endpoints carry a challenge plus honeypot and user-agent checks, while checkout and cart endpoints deliberately do not, because a buyer whose ad blocker breaks the challenge must never lose a purchase to a spam gate.
Never put a challenge in front of money
This is the rule most sites get wrong. A CAPTCHA on a checkout or booking step converts a small spam problem into a revenue problem, because a proportion of real customers fail it, give up, or never see it load at all.
Rate limiting protects those endpoints without turning anyone away.
Make the failure visible to you, not to them
When a submission is rejected, it should be logged where you can see it. Silent rejection means you cannot tell the difference between a working filter and a broken form, and a broken enquiry form can go unnoticed for weeks.
Check the messages inbox weekly for the shape of what arrives. A sudden drop to zero is worth investigating rather than celebrating.
Reduce the reward
Much form spam is looking for links to publish or an autoreply to exploit. Do not echo the submitted content back in an automatic reply, and do not publish submissions anywhere without review.
If the spam is mostly link-stuffing, a simple rule that rejects messages containing more than one or two URLs removes most of it with almost no false positives. For a clinic or a practice this matters twice over, since an enquiry form on a medical template is often the first thing a patient uses.
Watch what it costs
Once a month, compare enquiries received against enquiries expected. If a campaign or a busy week produced fewer messages than the traffic suggests, test the form yourself from a phone on mobile data.
That test catches the failure mode nobody notices: a form that has quietly stopped accepting anybody. The general reasoning about measuring the enquiry path is in what to measure on a small business website.
FAQ
Is a honeypot field still effective?
Against unsophisticated bots, which are most of the volume, yes. It is the best ratio of effectiveness to friction available, because real visitors never see it.
Should I put a CAPTCHA on my contact form?
On a pure enquiry form it is defensible. On checkout, booking or anything that leads to payment, it costs more in lost customers than it saves in spam.
Why am I suddenly getting more spam?
Usually a new form was indexed, or an address was harvested and sold. It rarely means anything is broken; it means you are now on a list.
Does hiding my email address help?
It reduces harvesting a little, but customers need to reach you. A form plus a visible address is a better trade than obscuring both.
Can I just turn the form off and use email only?
You will lose the enquiries from people who will not open a mail client, which on mobile is a meaningful share. A working form outperforms a mailto link.