Stopping Contact Form Spam Without Blocking Real People
Almost every website with a contact form gets spam: automated posts full of links, fake enquiries and junk that buries the real ones. The usual reaction is to add a puzzle that visitors must solve, but that also turns away some genuine customers, including people with disabilities. This guide covers the measures that stop most spam with little or no effort from visitors, in a sensible order, based on the W3C note on the inaccessibility of CAPTCHA, Google reCAPTCHA and Cloudflare Turnstile documentation, and the OWASP input validation cheat sheet, all checked on 29 October 2026.
Why visible CAPTCHAs are a last resort
A CAPTCHA asks the visitor to prove they are human, for example by reading distorted text or picking out pictures. The W3C's Accessible Platform Architectures Working Group note Inaccessibility of CAPTCHA (draft of 16 December 2021) says that "the very nature of the interactive task inherently excludes many people with disabilities, resulting in a denial of service to these users". It also notes that research shows many popular CAPTCHA techniques "are no longer particularly effective or secure". Its conclusion recommends that the purpose and effectiveness of any CAPTCHA be "carefully considered before adoption, and then closely monitored".
For a business, every blocked visitor is a lost enquiry. So start with the measures visitors never see, and add a challenge only if spam still gets through. Our website accessibility basics guide covers the wider picture for forms.
Validate everything on the server
Spam bots often skip your web page and post straight to the address the form submits to, so anything checked only in the browser can be bypassed. The OWASP Input Validation Cheat Sheet lists client-only checks as a common pitfall: "Validate on the server even when the browser checks the same fields. Client-side validation is bypassable". On the server, check that:
- Required fields are present and the email address looks like an email address.
- Each field has a sensible maximum length.
- Fields such as a dropdown only contain one of the values you offered.
- Any anti-spam token (see below) is verified.
Keep browser checks too, because they give real visitors instant feedback, but do not rely on them. Our website security basics guide covers keeping form plugins and the rest of the site up to date.
Honeypot fields
A honeypot is an extra form field that people do not see but simple bots fill in. If it arrives with something in it, the submission is discarded. The W3C note describes honeypots as "easily implemented even in hand authored markup" and says they "should be considered"; it points out that they are supported in several content management systems.
Do it carefully so it does not trip up real people. Hide the field with CSS rather than relying on visitors to ignore it, keep it out of the keyboard tab order, and give it a label such as "Leave this field empty" in case a screen reader or an autofill tool reaches it. Do not name it "email" or "phone", or browsers may fill it in automatically.
Rate limits and simple checks
Real people send one or two enquiries, not hundreds. Limiting how many submissions one address or connection can make in a period stops floods without affecting normal visitors. The W3C note discusses limits of this kind and heuristics such as the volume of requests and the way data is entered, while warning that heuristics need careful study of your own traffic and that bots change their behaviour to get around them.
- Limit submissions per IP address per hour, and show a polite message if the limit is hit.
- Reject forms submitted within a second or two of the page loading, which people cannot do.
- Hold, rather than reject, messages that contain many links, and review them.
Spam filtering
Content filters look at the message itself. The W3C note says that applications using "hot words" or Bayesian filtering to spot spam patterns are "very popular, and quite effective", and that properly tuned systems "can achieve results comparable to a traditional visual CAPTCHA" without any burden on the user. Many form plugins and email systems offer this. Send suspected spam to a folder you check now and then, rather than deleting it, so a misjudged real enquiry is not lost.
reCAPTCHA and Turnstile
If spam still gets through, a third-party check can help. The two most common are Google reCAPTCHA and Cloudflare Turnstile. Both can run without showing visitors a puzzle in most cases.
- reCAPTCHA v3 never shows a challenge. Google's v3 documentation says it returns a score for each request, where 1.0 is very likely a good interaction and 0.0 is very likely a bot, and suggests starting with a threshold of 0.5 and adjusting it for your traffic. Google recommends taking action "behind the scenes instead of blocking traffic", such as sending low-scoring messages for review.
- Turnstile is described in Cloudflare's documentation as working "without showing visitors a CAPTCHA" and without needing to send your site's traffic through Cloudflare. Cloudflare says it is WCAG 2.2 AA compliant.
Either way, the check is only complete when your server verifies it. Cloudflare's server-side validation page says "the client-side widget alone does not protect your forms", because an attacker can submit any string as a token. Turnstile tokens are valid for 300 seconds and can be used once. Google's verification page says each reCAPTCHA token is valid for two minutes and can only be verified once. A form plugin that adds the widget but never checks the result gives no real protection.
These services load scripts from a third party and may set cookies, so mention them in your privacy policy; see our privacy policy and cookie consent guide. Google's reCAPTCHA FAQ also says that if you hide the reCAPTCHA badge, you must show its branding text in the user flow instead.
The emails your form sends
A contact form usually emails each enquiry to you, and sometimes a copy to the visitor. Both can cause trouble:
- Send notifications from an address on your own domain, with the visitor's address in the Reply-To field. Sending "from" the visitor's address makes the message look forged to mail providers, and it may land in spam. Our guide to SPF, DKIM and DMARC explains how mail providers check this.
- Be careful with automatic copies to the visitor. Spammers can enter someone else's address to use your form to send them messages; keep any copy short and do not repeat the message text in it.
A sensible order to try things
- Server-side validation of every field.
- A honeypot field and a minimum time to submit.
- Rate limits per IP address.
- A spam filter, sending suspected spam to a review folder.
- An invisible check such as reCAPTCHA v3 or Turnstile, verified on the server.
- A visible challenge only as a fallback, with an alternative way to contact you, such as an email address or phone number.
Test the form after every change by sending a real enquiry yourself, including from a phone and using only a keyboard. A form that blocks spam but also loses customers is worse than a full inbox. For more on forms that convert, see our landing page checklist.
Frequently asked questions
Do I need a CAPTCHA on my contact form?
Often not. Server-side validation, a honeypot field, rate limits and a spam filter stop most automated spam without asking visitors to do anything. The W3C notes that interactive CAPTCHAs exclude many people with disabilities, so add one only if spam still gets through, and offer another way to contact you.
What is a honeypot field?
An extra form field that is hidden from people but that simple bots fill in. Submissions with anything in it are discarded. Hide it with CSS, keep it out of the tab order and label it to be left empty, so screen reader users and autofill tools are not caught by it.
Is reCAPTCHA v3 or Turnstile enough on its own?
No. Both give your page a token that your server must verify with the provider. Cloudflare says the client-side widget alone does not protect your forms, because anyone can submit a made-up token. Turnstile tokens are valid for 300 seconds and reCAPTCHA tokens for two minutes, and each can be used once.
What reCAPTCHA v3 score should I block?
Google suggests starting with a threshold of 0.5 and adjusting it based on your own traffic. It recommends acting behind the scenes rather than blocking, for example sending low-scoring messages to a review folder, so real enquiries are not lost.
Why do my contact form emails go to spam?
A common cause is sending each notification from the visitor's email address. Send it from an address on your own domain, with SPF, DKIM and DMARC set up, and put the visitor's address in the Reply-To field.
Need a contact or quote form that works without the spam? See how we approach website development and website maintenance, see all our services, or email info@creahive.com.