Know the kinds of spam
Most form spam comes from bots that find forms and fill every field with links or promotions. Some submissions come from real people paid to post advertisements, which are harder to stop automatically. A third kind is not spam at all but sales pitches from other businesses, which filters cannot judge.
Honeypot fields
A honeypot is an extra form field hidden from humans with CSS. Bots that fill every field reveal themselves, and the submission is discarded. It adds no friction for real people and blocks a large share of simple bots. Many form plugins offer it as a setting.
Make sure the hidden field is also hidden from screen readers, so people using assistive tools do not fill it by accident.
CAPTCHA and its alternatives
Classic image puzzles frustrate visitors and can create accessibility barriers. Newer services score visits invisibly or ask for a simple check. Evaluate them on three points: how well they block spam, how they treat accessibility, and what data they collect, which belongs in your privacy policy.
Time-based checks, which reject forms submitted in less than a couple of seconds, are another light option.
Server-side filtering and limits
Rate limits restrict how many submissions one address can send in a short time. Filters can reject messages containing multiple links, certain keywords, or text in alphabets you never serve. Email spam filters on your inbox add another layer. Services that check submitted addresses against known spam databases can also help.
Use rules carefully so a genuine customer who pastes a link to a photo does not get blocked.
Keep real leads safe
Store submissions in your site's dashboard as well as emailing them, so a message wrongly filtered by email can still be found. Show a clear confirmation message after sending. Offer a phone number next to the form for urgent matters.
Check your spam folder or filtered entries weekly at first, to confirm no valid inquiries are caught.
Layer the defenses
No single measure is perfect. A honeypot plus rate limits plus a light invisible check handles most small business sites well. Add stricter tools only if spam persists.
After changes, send a test from a phone and from a different email provider to confirm the form still works. If you changed anything that affects email delivery, see our guide on forms that do not send emails.
Document what you chose and why. If a future redesign swaps the form plugin, the protections can silently disappear and spam returns overnight. A short note listing the honeypot, rate limit and any invisible check helps whoever rebuilds the page confirm that each protection is carried over.
Pay attention to the wording of your form as well. Fields such as a website address attract spammers, so ask only for what you need, which is usually a name, a way to reply and a short message.
Common questions
Is CAPTCHA required?
No. Many sites use honeypots and invisible checks instead.
Why do I still get spam after adding protection?
Some comes from humans or from bots that learned to bypass the check. Layer another method.
Should I remove the form and just show an email?
That invites more spam, because addresses are harvested. A protected form is usually better.
This guide is general information. Search engines change how they work and their guidelines; check Google's current documentation for your situation. Nobody can guarantee a ranking.