Stop Contact Form Spam Without Killing Leads

Put a new contact form on the internet and it will start collecting submissions before a single real customer finds it. Nobody is targeting you. Scripts crawl the web looking for anything that accepts a POST request, and a form is the most obvious candidate there is — a public endpoint, advertised in the HTML, that anything can write to.

What happens next is where the damage gets done. The inbox fills with "I noticed your website could rank better on Google", the owner searches for a fix, and installs the most visible thing available — usually a tick-box challenge, sometimes a grid of traffic light photos. The spam drops. So do the enquiries. Only one of those changes shows up anywhere, because no report lists the people who gave up on the form and rang a competitor instead.

Our position: bot spam is a solved problem and the solution is invisible. Human-typed spam isn't a problem code can solve at all, and businesses that try pay for it in lost work. Every invisible defence first, visible friction only once you can show the invisible layer has failed.

Why forms attract spam at all

Automated submission is close to free. A script loads a page, finds every input, fills them with whatever it's carrying, and posts. Volume is the whole strategy, and the motives are mundane: backlink solicitation, malware links hoping a staff member clicks something inside an enquiry email, fake invoices, and probes checking whether your form will relay mail to an address you didn't choose.

A low-traffic site can receive more spam than genuine enquiries. Ten junk submissions and two real ones feels like a broken website. It's a normal one.

The detail that explains why most fixes underperform: your form endpoint can be posted to directly, without the page ever being loaded. Anything enforced only in the browser is a suggestion, not a rule. A challenge widget that renders on the page but is never verified on the server stops nothing — the bot skips the page entirely, and the business pays for that widget in conversion while getting no protection from it.

The escalation ladder

Each rung costs the visitor more than the one above it, so you only descend when the rung above has demonstrably failed on your own traffic.

Rung one is where most sites should stop

Four small things, all living on your server, none of which a visitor will notice.

A honeypot field. An extra input hidden from humans and irresistible to a script that fills everything it finds. If it comes back with content, discard the submission and return a normal success message, so the bot learns nothing. Name it something a script wants to fill, like website, not honeypot. Hide it with CSS plus aria-hidden="true" plus tabindex="-1" — get that wrong and you've built a field only blind visitors encounter, which sits squarely inside Australian accessibility obligations.

A submission time floor. Reject anything returning in under two or three seconds. Nobody types a real enquiry that fast. Keep the floor generous: it's a filter for scripts submitting in milliseconds, not a typing test.

Rate limiting. Three submissions per IP address per ten minutes is plenty. It won't stop a distributed bot, but it ends the most common pattern — one script hammering one endpoint for an hour.

A signed token. Issue a short-lived signed value when the page renders and refuse any submission without one. This closes the direct-to-endpoint hole, and it's the piece most off-the-shelf form handlers leave open.

Those add no scripts and ask nothing of the visitor. If a developer has told you spam protection means adding a widget, they've skipped the free part.

Turnstile and reCAPTCHA, compared honestly

Cloudflare Turnstile

If the invisible layer isn't holding, Turnstile is where we'd go next. It runs non-interactive checks in the browser and hands your server a token to verify. Most visitors see a small box that ticks itself. There are no photo grids.

It's free at any volume a small business will generate, and it doesn't require you to host or proxy anything through Cloudflare, so it bolts onto a site hosted anywhere. Cloudflare also doesn't sell advertising, which makes the question of what happens to your visitors' data a shorter conversation.

It isn't a wall — determined operators route around any browser challenge using human solver farms. Load it only on pages that carry a form; a challenge script on every page is a performance cost you're paying for nothing.

What reCAPTCHA costs you

Google's version is the default because it's the one everyone has heard of, not because it suits a small service business.

v3 scores instead of challenging. It returns a number between 0.0 and 1.0 for every visitor and leaves you to pick a threshold — most implementations use the documented default of 0.5 and never touch it again. The failure mode is quiet and expensive: the visitors it scores badly are disproportionately those on a corporate VPN, on strict tracking protection, or on a locked-down office network. In B2B, that describes a lot of buyers, and you'll never know they tried. Google's own guidance is to treat a low score as a reason to step up verification rather than reject outright; almost every implementation we open does the opposite.

v2 asks the visitor to prove themselves. The tick box is tolerable until it escalates into image selection, at which point you've handed a prospective client a puzzle on a phone screen — and for visitors with low vision or motor impairment, sometimes an outright barrier.

There's a data question too. The script reports on visitor behaviour from every page it loads on; whether that creates a legal obligation depends on whether your business is covered by the Privacy Act, and the OAIC is the place to check. Commercially the sum is simpler: you're adding a third-party tracker to your highest-intent page to solve a problem four free server-side checks would have handled.

The options that cost more than the spam

Once frustration sets in, businesses reach for measures that feel decisive and behave like a tax on real enquiries.

Making the phone number mandatory. The most reliable way to reduce completions on a service-business form, which we covered in the three fields worth deleting. It does nothing about spam either, since a script fills a phone field as happily as any other.

Maths questions and "what colour is the sky". Trivially handled by anything modern. The only party inconvenienced is the human.

Long qualifying questionnaires. They filter, just not for quality. Busy, senior, well-funded enquirers abandon a nine-field form fastest.

Deleting the form for an email address. Published addresses get scraped constantly, so you keep the spam and lose everything a real form does. We made that case in contact form versus mailto.

Run the arithmetic instead of trusting the annoyance. Twenty spam submissions a week at ten seconds each to recognise and delete comes to about a quarter of an hour a month. Use your own figures and the shape holds: spam is a known, small, recurring inconvenience, while friction costs you an unknown number of projects that never announced themselves. For a custom build starting at $8,000, one enquiry lost to a puzzle outweighs years of deleted email.

The spam that isn't bots

Some of it is people. Humans in outsourced lead-generation shops, working through lists of Australian business websites and typing into forms by hand. Their submissions are grammatical, correctly formatted, sometimes personalised with your business name.

No invisible defence catches them, because there's nothing to catch. Turnstile passes them. reCAPTCHA scores them as human, correctly. They are human. Recognising that early saves you from escalating the ladder chasing a zero you can't reach.

What helps is unglamorous. Route form notifications to a dedicated address so you can write aggressive filter rules on the phrases that repeat without risking real mail. Never reply and never click unsubscribe; both confirm a human reads the address.

The silent lead-killer: notifications nobody receives

This one is worse than spam and hides behind it. The form works. The submission is valid. Nobody at the business ever sees it.

The usual cause is a form handler that sends the notification with the enquirer's address in the From field, because it seems convenient for hitting reply. Your server isn't authorised to send as their mail provider, so the message fails authentication and gets filed accordingly. The other causes are as ordinary: a shared hosting mail server whose reputation belongs to everyone else on that machine, or an info@ address forwarding to someone who left in 2023.

The fix has three parts. Send from your own authenticated domain through a transactional email service, with Reply-To set to the enquirer so replying still works. Store every submission in a database or CRM, so the email is a notification rather than the only copy of the lead. And send the enquirer an immediate confirmation, which gives you a second signal when the flow breaks.

Then test it monthly: submit your own form from a phone on mobile data, using an address you don't control, and confirm it lands in the inbox rather than the junk folder. Almost nobody runs that check after launch, which is why "plenty of traffic, no enquiries" is so often a mail problem wearing a marketing costume. If that sounds familiar, the diagnosis walkthrough covers the other causes in order.

FAQ

Does adding a CAPTCHA hurt my Google rankings?

Not directly — Google doesn't penalise sites for using a challenge widget. The indirect effect is real: a challenge script loaded across every page adds weight and delays interaction, which shows up in your Core Web Vitals. Load it only where there's a form and the ranking question mostly disappears. The conversion question doesn't.

Is Cloudflare Turnstile actually free?

Yes, at any volume a small business site will produce. You need a free Cloudflare account for the site and secret keys, but you don't need to move your DNS or host anything with Cloudflare.

Why am I still getting spam after installing reCAPTCHA?

Two likely reasons. Some of your spam is typed by humans, and a bot-detection widget will always pass a real person. The second is more common than people expect: the widget renders on the page but is never verified on the server, so a script posting directly to the endpoint bypasses it entirely.

How much form spam is normal?

There's no benchmark worth quoting — it swings with how long your domain has existed and how visible it is. The useful measure isn't volume, it's clearing time. A few seconds a day means you have an inbox rule to write, not a puzzle to put in front of your customers.

Where we'd start on your form this week

Work down the ladder, not up it. Confirm your form handler verifies everything server-side, including any widget you're already paying for in page weight. Add the honeypot, the time floor, the rate limit and the signed token — an afternoon's work, with no conversion cost. Only if spam keeps arriving in volume should you add Turnstile, and only on the pages that need it. While you're in there, run the deliverability check: From address on your own domain, Reply-To on theirs, every submission stored somewhere that isn't an inbox.

If you'd rather have the enquiry flow built correctly from the start, that's part of every small business website build we do — server-side validation, real transactional email, and no visitor-facing puzzles unless the traffic warrants them.

For a read on what your pages carry right now, run your URL through our free audit. It won't tell you how much spam you're getting. It will tell you which third-party scripts load on your contact page and what they cost in speed — which, on a lot of the sites we look at, is the more expensive half of the problem.