{"id":30207,"date":"2026-06-23T09:47:00","date_gmt":"2026-06-23T08:47:00","guid":{"rendered":"https:\/\/www.web-systems.pl\/contact-form-spam-protection-without-annoying-customers\/"},"modified":"2026-10-13T14:55:58","modified_gmt":"2026-10-13T13:55:58","slug":"contact-form-spam-protection-without-annoying-customers","status":"publish","type":"post","link":"https:\/\/www.web-systems.pl\/en\/contact-form-spam-protection-without-annoying-customers\/","title":{"rendered":"Contact form spam: protection without annoying your customers"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The most effective way to stop contact form spam is a few invisible layers: a honeypot field, a check on how long the form took to fill in, and a content filter. Captcha? Only at the very end, as the last line of defense.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With this setup, bots drop out before the customer even notices that anyone is checking them. Is your inbox flooded with SEO offers, and since you added an image puzzle, customers keep calling to say &#8220;I can&#8217;t send the message&#8221;? Then this guide is for you. We judge every method from three angles: whether it works in practice, how much effort it costs the user, and whether it shuts out people with disabilities.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of contents<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.web-systems.pl\/en\/contact-form-spam-protection-without-annoying-customers\/#Where_does_contact_form_spam_come_from\" >Where does contact form spam come from?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.web-systems.pl\/en\/contact-form-spam-protection-without-annoying-customers\/#Why_does_captcha_put_customers_off\" >Why does captcha put customers off?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.web-systems.pl\/en\/contact-form-spam-protection-without-annoying-customers\/#Invisible_methods_of_protecting_a_form_from_bots\" >Invisible methods of protecting a form from bots<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.web-systems.pl\/en\/contact-form-spam-protection-without-annoying-customers\/#reCAPTCHA_and_alternatives_when_verification_makes_sense\" >reCAPTCHA and alternatives: when verification makes sense<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.web-systems.pl\/en\/contact-form-spam-protection-without-annoying-customers\/#Content_filtering_and_server-side_safeguards\" >Content filtering and server-side safeguards<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.web-systems.pl\/en\/contact-form-spam-protection-without-annoying-customers\/#How_to_block_spam_in_a_WordPress_form_step_by_step\" >How to block spam in a WordPress form step by step?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.web-systems.pl\/en\/contact-form-spam-protection-without-annoying-customers\/#Frequently_asked_questions\" >Frequently asked questions<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.web-systems.pl\/en\/contact-form-spam-protection-without-annoying-customers\/#Is_a_honeypot_alone_enough_to_block_spam\" >Is a honeypot alone enough to block spam?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.web-systems.pl\/en\/contact-form-spam-protection-without-annoying-customers\/#Is_reCAPTCHA_v3_visible_to_the_user\" >Is reCAPTCHA v3 visible to the user?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.web-systems.pl\/en\/contact-form-spam-protection-without-annoying-customers\/#How_do_I_check_that_captcha_is_not_blocking_customers\" >How do I check that captcha is not blocking customers?<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Where_does_contact_form_spam_come_from\"><\/span>Where does contact form spam come from?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most of this junk is sent by automated bots that comb the web looking for open forms. A human pasting in an ad by hand? It happens, but far less often. What you get most often is:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>SEO links<\/strong> pasted in the hope of a free backlink,<\/li>\n<li>phishing that pretends to be a bank, a courier or a domain registrar,<\/li>\n<li>service offers, from SEO to &#8220;hot leads&#8221;,<\/li>\n<li>code injection attempts, meaning tests of whether the form will let a script or a database query through.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Popular plugins and default form addresses only make things easier for bots. One well-known field layout and they can run through a huge number of sites. Oh, and bots are not all equal. The simple ones fire a request straight at the server without loading the page at all. The advanced ones launch a real browser and run JavaScript. And that decides which protection will work at all.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Why_does_captcha_put_customers_off\"><\/span>Why does captcha put customers off?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A classic captcha pushes the verification onto the human, so every harder test is a risk that the customer will simply close the tab. The people hit hardest are blind users, people with dyslexia and everyone who uses a screen reader or navigates the site with the keyboard alone. For them, an image puzzle can be a wall. And the audio version? Often it is impossible to understand. That is why captcha accessibility comes up in every audit, and <a href=\"https:\/\/www.web-systems.pl\/en\/wcag-websites\/\">websites compliant with WCAG<\/a> have to offer another way to verify or to get in touch.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There are also problems on phones with small screens, with script blockers and in private mode, where the test can loop forever. And reCAPTCHA sends data about the visitor to Google, so your privacy policy has to cover that.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Invisible_methods_of_protecting_a_form_from_bots\"><\/span>Invisible methods of protecting a form from bots<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The best protection of a form from bots works in the background and asks nothing of the customer. Proven layers:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>a honeypot in the form<\/strong>, meaning a hidden field that only a bot will fill in,<\/li>\n<li>a minimum fill-in time: if the message was sent faster than a human could have read the fields, it goes in the bin,<\/li>\n<li>a one-time token generated by JavaScript, which a bot without a browser cannot get,<\/li>\n<li>a limit on submissions from one IP address within a set time.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The trap field has to be hidden in a way that does not confuse screen readers. The container gets <em>aria-hidden=&#8221;true&#8221;<\/em>, and the field itself gets <em>tabindex=&#8221;-1&#8243;<\/em> and <em>autocomplete=&#8221;off&#8221;<\/em> (otherwise the browser may fill it in on its own and a real customer ends up in spam). The catch is that an advanced bot will get around a single layer with no trouble. That is why the methods are always combined.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"reCAPTCHA_and_alternatives_when_verification_makes_sense\"><\/span>reCAPTCHA and alternatives: when verification makes sense<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If the invisible methods are not enough, reach for verification without puzzles, for example reCAPTCHA v3 or Cloudflare Turnstile. Version v2 shows a checkbox, and when it has doubts, images to click pop up. Version v3 assesses the risk in the background and returns a score, and you decide what to do with the submission. Turnstile checks the browser without images and tracks the user less.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Other alternatives to reCAPTCHA are hCaptcha, Friendly Captcha and a simple text captcha or a question that a screen reader can read out without any tricks. When choosing, look at three things: accessibility for all visitors, the scope of personal data being sent, and how easy it is to plug into the plugin you already use. That last point tends to be underrated.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Content_filtering_and_server-side_safeguards\"><\/span>Content filtering and server-side safeguards<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Whatever slips through the form can still be sifted out on the server before it lands in <a href=\"https:\/\/www.web-systems.pl\/en\/web-hosting-and-email-hosting\/\">your mail inbox<\/a>. A word and link filter will stop messages stuffed with links. Field validation will reject, for instance, a URL typed into the &#8220;name&#8221; field (bots do that). Anti-spam services such as Akismet compare the content with a database of known spam and flag suspicious submissions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A form is only as secure as the whole site. Hence the value of regularly <a href=\"https:\/\/www.web-systems.pl\/en\/wordpress-security-hardening-protect-your-site-from-attacks\/\">hardening WordPress step by step<\/a>: updates, an application firewall, blocking suspicious IP addresses. The last filter is email. Anti-spam filters and SPF and DKIM records set up properly in the domain&#8217;s DNS decide whether real inquiries reach the recipient at all. This is easier to sort out when you have solid business email hosting.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_to_block_spam_in_a_WordPress_form_step_by_step\"><\/span>How to block spam in a WordPress form step by step?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Start with the lightest layers. Add the next ones only when spam is still getting through:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>a honeypot and a fill-in time check,<\/li>\n<li>field validation and a content filter,<\/li>\n<li>invisible verification, meaning Turnstile or reCAPTCHA v3,<\/li>\n<li>an interactive captcha switched on only for suspicious traffic.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Most plugins have some of these options built in. We show them in an example where we set up a <a href=\"https:\/\/www.web-systems.pl\/en\/how-to-create-contact-form-wordpress-wpforms\/\">contact form in WPForms<\/a>. After every change, send a message from a phone, with the keyboard alone and with a screen reader turned on. Then look in the spam folder. There is no point assuming that because the form showed &#8220;sent&#8221;, the message arrived.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Well-organized, layered protection cuts down contact form spam without punishing real customers along the way. It is simplest when <a href=\"https:\/\/www.web-systems.pl\/en\/wordpress-websites\/\">company websites on WordPress<\/a> are designed with security and accessibility in mind from the start.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Frequently_asked_questions\"><\/span>Frequently asked questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1790308605955-0\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><span class=\"ez-toc-section\" id=\"Is_a_honeypot_alone_enough_to_block_spam\"><\/span>Is a honeypot alone enough to block spam?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>For simple bots, usually yes, because they fill in every field they find in the code. Advanced ones recognize hidden fields and skip them. In that case, add a fill-in time check and a content filter.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1790308605955-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><span class=\"ez-toc-section\" id=\"Is_reCAPTCHA_v3_visible_to_the_user\"><\/span>Is reCAPTCHA v3 visible to the user?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No. It works in the background and shows no puzzles. You do need to set a score threshold, though, and think through the borderline cases, for example extra verification instead of rejecting the message. And remember that data about the visitor goes to Google in the process.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1790308605955-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><span class=\"ez-toc-section\" id=\"How_do_I_check_that_captcha_is_not_blocking_customers\"><\/span>How do I check that captcha is not blocking customers?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Test the form with a screen reader, with the keyboard alone and on a phone. After rollout, watch whether the number of inquiries from real customers has dropped. And leave another way to get in touch: a visible email address and phone number.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>The most effective way to stop contact form spam is a few invisible layers: a honeypot field, a check on how long the form took to fill in, and a content filter. Captcha? Only at the very end, as the last line of defense. With this setup, bots drop out before the customer even notices [&hellip;]<\/p>\n","protected":false},"author":9,"featured_media":30191,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[828,806],"tags":[1539,2223,1705,2228,901,2240],"class_list":["post-30207","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-web-development-en","tag-accessibility","tag-captcha-x","tag-contact-form","tag-honeypot-x","tag-security","tag-spam-x"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/posts\/30207","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/comments?post=30207"}],"version-history":[{"count":3,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/posts\/30207\/revisions"}],"predecessor-version":[{"id":30256,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/posts\/30207\/revisions\/30256"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/media\/30191"}],"wp:attachment":[{"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/media?parent=30207"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/categories?post=30207"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/tags?post=30207"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}