How to stop spam floods on your website contact form
Contact form spam comes from bots that work through millions of websites, filling in every form they find. You can stop most of it without annoying real customers: start with free, invisible checks such as a hidden honeypot field and a time check, make sure the form cannot be used to send spam to other people, and add a challenge without puzzles, such as Cloudflare Turnstile, only when bots still get through. This article explains each layer and what it costs your visitors.
Why your contact form fills with junk
To a bot, a contact form is a free way to deliver a message to a real person. Spammers use forms to advertise and to send phishing links. The OWASP Foundation, which catalogues web security threats, lists form spam among the automated threats every website faces. It is the same worldwide, and it has nothing to do with how popular your site is.
No single defence is enough. Some bots defeat challenges, and others rotate through thousands of addresses so that blocking one does nothing. The answer is several light layers.
Start with the free layers your visitors never see
A honeypot field
A honeypot is an extra field in the form that is hidden from people. A person never fills it in. Many bots fill in every field they find, so any message with that field completed is discarded. It costs visitors nothing. Two details matter: label the field so screen readers skip it, and turn off browser autofill for it, or a genuine visitor's browser may fill it in.
A time check
People take time to read a form and type. Bots submit in a fraction of a second. A form that rejects submissions made within a few seconds of the page loading stops many simple bots.
Sensible field rules
Check the content on your server, not only in the browser. A name field does not need web links. A phone field needs digits. A message that is mostly links is almost certainly spam.
Close what you do not use
If you do not reply to comments on your website, switch comments off. Every open form is an invitation. For WordPress comments you do keep, the free plugin Antispam Bee works without a third-party service, though its own documentation says it does not protect form plugins.
Our help article on stopping comment and form spam in WordPress shows how to set these up.
Make sure your form cannot be used to spam other people
Some spam is not aimed at you. A badly written contact form can be tricked into sending mail to anyone. If the form puts what a visitor typed into the From, Reply-To, Cc or Bcc line of the email without stripping out line breaks, a bot can add extra recipients and turn your website into a spam relay. Security researchers call this email header injection.
Reputable form plugins guard against it. Home-made forms often do not. If your site uses a form someone wrote years ago, have a developer check it, or replace it with a maintained plugin.
A related problem: forms that send a confirmation email to whatever address is typed in can be used to send unwanted mail to strangers. Protect registration and sign-up forms as carefully as the contact form.
When bots still get through: a challenge without puzzles
The old answer was a CAPTCHA: distorted letters or "click every traffic light". They frustrate everyone, bots increasingly solve them, and a W3C note on the subject explains how they shut out blind, partially sighted, deaf and dyslexic visitors. Newer challenges ask the visitor's browser to do the work instead.
Proof of work
The browser quietly solves a small maths problem before the form is sent. It takes a person's device a moment and costs a spammer sending thousands of messages real computing time. ALTCHA is an open-source example that you verify on your own server, with no outside service involved. It suits a custom-built site or a developer adding it to their own form. Its WordPress plugin is now a paid product.
Cloudflare Turnstile
Turnstile is Cloudflare's free replacement for CAPTCHAs. It runs checks in the background and at most shows a single checkbox, never images or text to decipher. The points worth knowing, from Cloudflare's own documentation:
- It is free on Cloudflare's Free plan, with unlimited checks.
- It works on any website. You do not need to move your site to Cloudflare, though you need a free Cloudflare account for the keys.
- Your server must check the answer. Cloudflare is plain about it: the widget on its own does not protect the form. The form has to send Turnstile's token to Cloudflare for checking before it accepts the message.
- It handles some visitor data. Turnstile processes the visitor's IP address and browser details and uses cookies and local storage to work. Cloudflare does not read what people type into the form. If you use the invisible version, Cloudflare requires a mention in your privacy policy.
- Cloudflare says it meets the WCAG 2.2 AA accessibility standard.
On WordPress, Contact Form 7, WPForms and Formidable Forms support Turnstile directly. For other forms, a free community plugin adds it to WordPress login, registration, comments, WooCommerce and most popular form plugins.
Keep an eye on the form after changes
A form that silently stops working is worse than spam: real customers think they have contacted you. After any update to WordPress or your form plugin, send yourself a test message.
How we help
WordPress Care keeps comment spam out by default and, after each weekly update cycle, checks that the functions you rely on, such as your contact form, still work. The Cloudflare add-on, added to a Noiz hosting plan from the client area, keeps your DNS synchronised to Cloudflare from the control panel and manages Cloudflare at a predefined level. If spam is flooding your forms, open a ticket and tell us what you are seeing.
Sources
Checked 19 October 2026.
Threats and accessibility
- OWASP, OAT-017 Spamming
- OWASP, Credential stuffing prevention cheat sheet
- W3C, Inaccessibility of CAPTCHA (Group Draft Note, 2021)
- MITRE, CWE-93: CRLF injection
- PHP manual, mail()
Cloudflare Turnstile
- Turnstile overview
- Turnstile plans
- Turnstile widget types
- Turnstile server-side validation
- Turnstile mobile implementation (cookies and local storage)
- Turnstile Privacy Addendum
- Turnstile community resources
Open-source and plugins
- ALTCHA and source code
- Antispam Bee
- Contact Form 7 and release 6.1.0 (Turnstile support)
- Simple CAPTCHA with Cloudflare Turnstile (community plugin)
- WPForms, Setting up Cloudflare Turnstile
- Formidable Forms, Cloudflare Turnstile
Noiz
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
