How to Stop Spam Form Submissions on Your Contact Page

To stop spam form submissions on your contact page, combine a CAPTCHA check, a hidden honeypot field, and rate limiting. That three-layer setup blocks most automated bots. Add input validation and regular submission audits, and you will also catch the scripted fills that get past simple checks.

No single method works forever. Bots adapt. The goal is to make your form too annoying to attack, not to build a perfect wall.

What counts as a stopped submission?

A stopped submission never reaches your inbox or CRM. A filtered submission arrives but gets flagged. Most contact-form spam is automated: scripts find the form, fill every field, and submit as fast as the network allows. Some spam is human, written by people paid to post links. CAPTCHA and honeypots stop the first group. Review rules and moderation stop the second.

Before you start: what you need

• Edit access to your form, whether it lives in WordPress, HubSpot, Webflow, or custom code.
• A way to add a small snippet of JavaScript if your form builder does not have built-in spam controls.
• A place to review submissions, such as the form dashboard, email inbox, or CRM.
• Access to your ad accounts and click IDs if the contact page is also a paid landing page.

How to stop spam form submissions: step by step

Work through these steps in order. Each one closes a different hole.

Step 1: Turn on CAPTCHA on the form

Install a managed CAPTCHA service such as Google reCAPTCHA, Cloudflare Turnstile, or hCaptcha. If your form builder has a built-in CAPTCHA toggle, start there. Choose the invisible version when you can, because it interrupts fewer real visitors. The goal is to challenge the browser, not the person.

Step 2: Add a honeypot field

Add a real-looking text field, hide it with CSS, and label it something like Website. Real people never see it. Bots see every field and fill it. If the hidden field has any value, reject the submission and do not send the email. Do not announce the catch. Just show a generic success message or redirect back to the page.

Step 3: Rate limit and check submission timing

Limit submissions per IP address to three per hour. Add a timestamp when the form loads. If the form is submitted faster than a human could type, reject it. A common rule is to discard anything submitted in under two seconds, but test with your real visitors first.

Step 4: Validate inputs and block known junk

Check that email addresses use a real format and reject throwaway domains. Reject submissions that contain common spam phrases. Block IP ranges that keep sending. For high-value lead forms, consider double opt-in by email after the first message.

Step 5: Review real submissions for patterns

Every few days, look at the messages that got through. Sort by time, IP, and the text itself. A burst of similar messages from one IP means your rules missed something. Update your blocklist, honeypot, or rate limit accordingly.

Step 6: Preserve evidence when bots come from paid ads

If your contact page is a landing page for Google Ads or Meta ads, fake submissions can also waste ad spend. Keep the click ID, session recording, and behavior signals for each submission. Tools like BotRefund automatically document click IDs, recordings, and behavior signals. That evidence supports refund claims with Google and Meta.

Step 7: Verify it worked

Submit a normal test message yourself. Then try to submit with no delay, fill the hidden field, and use a throwaway email. All three should fail or get flagged. Ask one or two real customers to test the form and confirm they are not blocked. If a real message is blocked, relax the rate limit or change CAPTCHA mode.

Key facts about bot and spam form submissions

The table below comes from BotRefund's published materials. Use it to judge how serious the problem is for your own campaigns.

Common mistakes that let spam through

• Using CAPTCHA alone. Bots with modern browsers can sometimes pass image challenges, and human spam ignores them.
• Hiding the honeypot with display:none. Some simple bots skip hidden elements. Use a visually hidden field that is still in the DOM.
• Forgetting rate limits. A form with no limit can be hammered thousands of times per hour.
• Rejecting too much. Over-strict rules block real customers with shared IPs, such as office Wi-Fi.
• Never reviewing submissions. Spam evolves. The rules that worked six months ago may be useless today.

When these steps are not enough

If you face targeted human spam, no technical check will stop it. You need moderation, an approval queue, or a form that requires a login. If the spam comes through distributed residential proxies, IP-based rate limits will not help. Use behavioral signals and session data instead. CAPTCHA, honeypots, and rate limits reduce volume. They do not guarantee a clean inbox.

Terms that help when you read support docs

• CAPTCHA - A test that asks the browser or the user to prove it is not a bot.
• Honeypot - A hidden form field that only bots fill in.
• Rate limiting - A rule that caps how often one IP address can submit.
• Validation - Checking that the data looks real before accepting it.
• Behavioral signals - Mouse movement, typing speed, and other actions that separate humans from scripts.

Frequently asked questions

What if my form builder doesn't have CAPTCHA?

Add a reverse proxy or a small JavaScript integration. Cloudflare Turnstile and hCaptcha can be added to most forms with a snippet of code.

Will CAPTCHA hurt conversions?

It can, if you use a heavy challenge. Invisible CAPTCHA modes have less impact. Test the form with real visitors before assuming it is safe.

How can I tell if spam is from bots instead of people?

Check speed. A human takes several seconds to type a message. Also check for bursts of identical submissions from one IP or at odd hours.

Should I require email verification for every contact message?

Only for high-value lead forms. It adds friction, but it stops many fake addresses. For a general contact page, a CAPTCHA is usually enough.

Can I get a refund for ad spend wasted by bot form submissions?

Yes, if you can document invalid clicks with click IDs, recordings, and behavior evidence. Meta and Google consider refund requests when the invalid activity is proven.

How often should I update my spam rules?

Monthly, or after any burst of spam. Set a calendar reminder to review submissions and adjust rules.