The site goes live with a contact form. Fine for a few days, and a fortnight later a dozen submissions arrive daily — gibberish, links, or English emails selling something.
The first instinct is to wonder who is targeting you. Nobody is. Form scanners are fully automated and sweep the whole internet, so a new site is found regardless of who you are or how much traffic you have.
Here are the common defences: what each stops, what each costs, and why the best-known one is often not the right choice.
Two kinds of spam submission
They need different responses.
Automated. Software filling and submitting forms, dozens a day, usually gibberish, links or sales pitches. This is the overwhelming majority and is entirely stoppable.
Human. An actual person filling in your form to sell you something — SEO services, typically. Unstoppable, because it is indistinguishable from a genuine enquiry. Only filtering by hand works.
Fortunately the first kind is over ninety percent. Stop the automated submissions and the remainder is entirely tolerable.
1. A honeypot field
Include a field that people cannot see and software can, hidden with CSS. Humans never fill it; automated submitters fill everything. If it arrives with content, discard the submission.
Effectiveness: stops a large share of unsophisticated automation.
Cost: essentially zero. Visitors notice nothing, click nothing extra, and accessibility is unaffected when implemented properly.
Limitation: more capable software checks whether a field is visible and skips it.
Conclusion: at that cost there is no argument against it. It belongs in every form by default rather than as an option.
2. A timing check
Record when the form loaded and measure the interval at submission. People take several seconds to fill a form; software usually submits within one.
Effectiveness: combined with a honeypot, catches another portion.
Cost: also near zero and invisible.
Caution: do not set the threshold high. Someone pasting prepared text might finish in three seconds. Rejecting under two seconds is safe.
3. CAPTCHA
The best-known option, with badly underestimated costs.
Effectiveness: a good CAPTCHA service does stop the great majority of automation.
Cost: this is the point. CAPTCHAs drive away real customers. People who cannot read distorted text, people who mis-tap a grid of traffic lights three times on a phone, people in a hurry — a proportion of them simply give up.
For a small business receiving twenty enquiries a month, losing two genuine ones to stop ten daily spam submissions is a poor trade.
If you use one, use an invisible variant. Current services require no interaction in most cases and only present a challenge when something looks suspicious, which is a far better experience than picking out every traffic light.
4. Have no form
The most effective option and the least mentioned: remove the form and publish an email address and contact details instead.
No form, no form spam. And for some businesses it converts better — plenty of people distrust forms, suspecting nobody reads them, and prefer to email directly.
Our own site has no form, only an email address and a WeChat code. The reason is not only spam: people who fill in forms and people who write emails differ in intent. Removing the form filters out casual entries and raises the quality of what remains.
This does not suit everything. Anything requiring structured information — choosing an appointment time, selecting services for a quote — still needs a form.
One caveat: an email address published on a page will be harvested and the mailbox itself will receive spam. But email spam filtering is mature and considerably easier to live with than form spam.
The combination we recommend
For most small business sites:
Honeypot plus timing check. Both free, both invisible, together stopping over ninety percent.
No traditional CAPTCHA, unless the volume remains intolerable after those two.
If a CAPTCHA is required, use an invisible one, and watch whether enquiry volume falls after adding it.
Add a submission rate limit — one submission per IP per minute — which stops bulk flooding.
An overlooked consequence
The real cost of spam is not receiving it. It is that you stop reading form notifications.
A dozen a day for a fortnight and you begin skimming past them. Then one real enquiry arrives among them and gets skipped with the rest. That loss is invisible and considerably worse than the spam itself.
So the test is not how much spam arrives but whether you still read each one properly. If you do not, it has become a problem worth solving.
One more thing: confirm your form actually delivers. A surprising number are broken — the submission reports success, and the email is never sent or lands in a spam folder. You then receive neither spam nor genuine enquiries, and nothing indicates anything is wrong.
Submitting a test yourself and confirming it arrives is a launch step that is frequently skipped. We submit one before handover and check it was received, because a silently broken form is the most expensive failure in this category.