Hosting & support · Forms
One tool rarely stops all form spam. A few light layers do, as long as you test that genuine inquiries still arrive.
Four layers, from lightest to strongest
WordPress and Contact Form 7 specifics
How to avoid blocking real leads
Tell us what you need and we’ll get back to you. Or book a free 30-minute call. Or call 954-539-5678.
To stop contact form spam, layer a few defenses: add a hidden honeypot field to catch simple bots, add an invisible challenge such as Cloudflare Turnstile or Google reCAPTCHA v3 to catch smarter ones, run submissions through a content filter like Akismet to catch human-typed spam, and add server or firewall rules for repeat offenders. Check every token on the server, not just in the browser. Then test regularly that real inquiries still reach your inbox, because over-aggressive spam settings cost you leads silently.
Bots crawl the web looking for forms. Some post links to improve their own search rankings, some test stolen card numbers or email addresses, and some push phishing links or sales pitches. Some “spam” is typed by people paid to fill forms by hand, which is why a single bot check never catches everything. Knowing which kind you get helps you pick the right layer. Look at a week of submissions before choosing a fix.
A honeypot is a form field hidden from people but visible to bots in the page code. Humans leave it empty. Many bots fill every field, so anything with that field filled is rejected. It costs visitors nothing and blocks a surprising share of basic spam.
Tips: hide the field with CSS rather than making it a hidden input type, give it a plausible name, and exclude it from screen readers with an appropriate attribute so it does not confuse visitors using assistive technology. Many form plugins include a honeypot option. For Contact Form 7, it is available through an add-on plugin.
These services check whether a visitor behaves like a human without making them pick out traffic lights.
Cloudflare’s documentation describes managed, non-interactive and invisible widget types. It runs checks in the background and only occasionally shows a checkbox. Your server must validate each token through Cloudflare’s Siteverify API.
Returns a score from 0.0 (likely bot) to 1.0 (likely human) for each request. Google’s documentation suggests starting with a threshold of 0.5, then adjusting based on your own traffic. As of 2026, Google’s billing page lists a free tier of up to 10,000 assessments per calendar month per organization.
Two rules apply to both. First, verify the token on your server. A check that only runs in the browser is easy for bots to skip. Second, decide what happens to borderline scores: rather than rejecting them outright, flag them for review so a real customer is not lost.
Human spammers pass bot checks, so filter on what the message says.
Spam burying your real inquiries? Book a free 30-minute call. We look at what you have now and tell you what we’d change first. No obligation.
The goal is fewer junk messages, not zero messages. After any change:
If your form gets little spam but also few leads, the issue is likely elsewhere. Our guide to conversion rate optimization covers what to check.
Do not add every layer at once. Start light and add only what your spam requires:
This keeps the form as easy as possible for real customers while still dealing with the spam you actually get.
Keep a short log of what you changed and when. If leads drop or spam returns, the log shows which setting to look at first, and whoever maintains the site next will understand why each layer is there.
Our website hosting and support includes constant automated monitoring and malware cleanup, and we keep WordPress and plugins updated. When we build a new website, forms are set up with spam protection, stored entries and lead tracking from launch.
Book it now · Free
Pick a time. We look at what you have now with you and tell you what we would change first. No obligation.
Prefer to talk now? Call 954-539-5678, or send the form and we’ll contact you.
Layering works better than any single tool: a honeypot, an invisible challenge like Turnstile or reCAPTCHA v3 verified on the server, content filtering such as Akismet, and rate limits.
Both work. Turnstile focuses on invisible checks with an occasional checkbox. reCAPTCHA v3 returns a score you set a threshold for. Choose based on your platform and plugin support.
Connect Akismet, add a reCAPTCHA or Turnstile integration, use a honeypot add-on, add keyword rules for common spam phrases, and store entries in the database.
Some spam is typed by people, who pass bot checks, and checks that are not verified on the server can be bypassed. Add content filtering and confirm server-side verification.
Yes, if settings are too strict. Flag borderline submissions instead of rejecting them, check flagged entries weekly and test the form after every change.
