Help Centre / Tips And Tricks

Stop Contact Form Spam

Updated 2 October 2026

You launch a site on Tuesday. By Wednesday morning the inbox has nine messages about search engine optimisation and one offering cryptocurrency. Nobody has linked to the site. Nobody has been told it exists.

It is worth understanding why that happens, because the explanation points straight at the fix.

Bots Do Not Visit Your Website

A human fills in your form by loading the page, typing, and pressing send. A spam bot does none of that. It sends a request straight to the address your form submits to, with the field names filled in, and never loads the page at all.

That rules out a whole category of defence. Anything that depends on the visitor having seen your page cannot help, and that is most of the advice you will find.

And They Find New Sites Through Certificate Logs

When a certificate is issued for a hostname, that hostname is published in a public certificate transparency log. The logs exist for good reasons: anyone can check which certificates have been issued for their domain, which is how fraudulent ones get caught. They are also a live feed of every new website on the internet, free to read and updated within minutes.

So a new site does not need to be indexed by Google to be found. The moment its certificate is issued, its hostname is public, and the scanners watching those logs will try /contact, /wp-comments-post.php and a few other usual addresses within hours. Search engines are the slower second route.

Nothing has leaked and nothing is wrong. It is why you want these defences in place before you launch rather than after the first wave.

Fix One: Add A Challenge

This is the fix that works, because it puts something in the request that a bot cannot produce.

A challenge gives the real visitor’s browser a token when they load the page, and your form will not accept a submission without a valid one. A bot posting directly has no token, so the submission is refused before it ever becomes an email.

Contact Form 7 and WPForms both support Turnstile and hCaptcha. Turnstile is the one to try first: it is free, it shows no picture puzzles, and most real visitors never notice it. Register the site with whichever service you pick and paste two keys into the form plugin’s settings. Allow ten minutes.

Fix Two: Add A Honeypot

A honeypot is a form field that humans never see, hidden with CSS. A bot reads your form markup, finds the field, and fills it in because that is what it does with every field. Your form then rejects any submission where that field is not empty.

It costs nothing, the visitor sees nothing, and it needs no third-party service. Most form plugins have it built in or as a small add-on.

A honeypot on its own will not stop everything, since the better bots have learned to skip hidden fields. Combined with a challenge it clears out most of what is left.

Fix Three: Stop Publishing Your Email Address

If hello@yourbusiness.com appears anywhere in your page source, it is being harvested. Scrapers read page source all day looking for that pattern.

Use the contact form as the only route in. Where an address has to be visible, put it in an image or have JavaScript assemble it after the page loads, and keep it out of a plain mailto: link. The encoding tricks from fifteen years ago are all solved.

Turn off WordPress comments on anything that does not need them while you are there. Comment spam is the same problem through a different door.

Why This Is Worth An Afternoon

Beyond the nuisance, there is a practical reason to deal with it.

Every spam submission that gets through becomes a real email your website sends. A form being hammered sends hundreds of messages nobody wanted, which buries the enquiries you do care about, and mail that recipients mark as spam damages the sending reputation your order confirmations and password resets depend on. See transactional email explained.

Spam that is blocked before the form accepts it never becomes an email at all, which is why a challenge is better than a filter in your inbox.

What To Do In Order

1. Add Turnstile or hCaptcha to every form on the site, including the one in the footer you forgot about.
2. Turn the honeypot on in your form plugin.
3. Take raw email addresses out of your pages.
4. Turn comments off where you do not want them.
5. Watch for a day. The volume should fall to nothing.

If It Keeps Coming

Check you covered every form. A site with a contact page, a newsletter box and a quote request often has protection on one of the three.

If submissions keep arriving with a valid challenge token, they are probably not bots. Cheap manual spam exists, and the answer there is a filter on content rather than a challenge.

If the volume is enormous rather than annoying, open a ticket from the members area. Traffic at that scale is worth blocking before it reaches WordPress at all. It is also worth checking the site is clean, since a compromised site attracts attention from more than one direction. See malware scans.