Reduce contact-form spam without losing genuine enquiries

Separate form abuse from ordinary inbox spam

A spam message arriving at your public email address may have been sent directly by a mail sender. A form submission normally goes through your website’s submission handler first. Changing the form’s challenge cannot stop every message delivered directly to the mailbox.

Preserve a harmless, redacted example and ask which route produced it. Compare the notification’s known template, the form’s submission record if available and the time. A familiar subject or apparent sender is a clue, not conclusive proof: those details can be copied.

Do not infer that an email bypassed the form simply because you cannot find a saved entry. For example, Contact Form 7 does not save submitted messages by itself. Storage depends on the actual form system and enabled extensions.

Establish whether you are dealing with automated submissions, plausible-looking unwanted sales messages, a broken integration or mailbox spam. Human-written unsolicited enquiries may pass an automation challenge correctly; their content still needs a handling policy.

Use complementary controls with a clear purpose

A content filter assesses the submitted information. An automation challenge assesses a different aspect of the interaction. Request limits protect capacity. Clear field validation catches invalid input. These controls are related, but adding several overlapping challenge plugins does not automatically make them work together.

For example, Contact Form 7 documents an Akismet content-filter integration and a separate Turnstile integration. Those pages explain the integration points; they are not evidence that either feature is correctly enabled on your site. Check product eligibility and any cost before adopting a service.

Use the form plugin’s supported integration where suitable. Identify and remove conflicting duplicate integration work only through a controlled change plan. Do not paste a snippet that bypasses every spam decision simply because it makes your test message arrive.

A honeypot can be another signal in a supported implementation, but a hidden field is not a universal human detector. Review how it behaves with assistive technology, browser autofill and the page’s caching system. Do not expect every automated sender to fill it or every human to leave it untouched.

Confirm that verification reaches the server

A visible challenge or success tick does not establish that the submission handler checked it. Cloudflare’s Turnstile validation documentation explicitly requires server-side verification. It also documents expiring, single-use tokens, so the supported integration must handle an enquiry that takes time to compose or a retry after an error.

Google’s reCAPTCHA v3 documentation describes scores, actions and adjusting the handling to the actual traffic. A score is a signal for a decision, not proof that a visitor’s enquiry is worthless. Do not copy another site’s threshold and treat its false-positive rate as your own.

Have the implementer verify the intended hostname, action and supported validation flow. Keep secret credentials on the server as required by the chosen integration. No secret belongs in a public page, screenshot or message sent to a general support forum.

Limit abuse without blocking whole groups unnecessarily

If submissions consume excessive resources, discuss request and resource limits with the site’s implementer or host. The OWASP denial-of-service guidance explains rate limiting and workload controls. Limits should target the relevant route and fit the legitimate task.

A visitor may retry after a confusing error, and several people can share a network. Treat broad address, country or email-domain blocking as a decision requiring evidence, not the default response to one unwanted message. Blocking common personal email providers can exclude real customers as well as spam.

A hypothetical local service form might receive several genuine messages from one office network. A very restrictive per-address rule could reject the second person even though both enquiries are relevant. Test that kind of expected use before deploying an aggressive rule.

If the form accepts attachments, keep upload validation and resource controls separate from spam classification. A passed challenge does not make a file safe. Our file-upload workflow guide covers that additional route.

Make false positives visible enough to investigate

Decide how staff will discover a real enquiry rejected by a filter. A supported review queue can help, but it introduces data storage and needs an owner and retention process. Do not enable permanent collection of every rejected message without considering what those messages contain.

Where Akismet is integrated with Contact Form 7 and Flamingo, the vendor documents reporting messages as Spam or Not Spam. Use the supported correction route for a known mistake rather than broadly allowlisting an entire public network. Other systems have their own review capabilities and limits.

Record the time, affected form, filter reason and the change made, using redacted information. If the system saves no rejected content, be honest about that limitation. It cannot retrospectively recover an enquiry it never retained.

Review a small, appropriate sample after a change and continue checking normal enquiries. Do not declare an improvement from a single successful administrator test or from a drop in notification volume alone.

Preserve an accessible visitor experience

W3C’s Inaccessibility of CAPTCHA explains barriers created by challenges and why alternatives matter. Test the actual method with a keyboard, on a narrow mobile screen and with the relevant accessibility requirements of your audience.

Make a verification failure understandable. Explain how to retry without unnecessarily clearing the visitor’s message, and provide an appropriate alternative contact route when the form cannot be completed. The W3C form notification guide covers clear errors and success feedback.

An alternative route should be practical, such as the website’s published contact address or another supported channel. Do not tell a visitor to turn off all security or privacy tools merely to contact you. Investigate whether your own loading or integration choices are excluding them.

Review privacy and maintenance as part of the setup

External filtering may send submitted data to another provider. Contact Form 7’s privacy notices distinguish its default behaviour from enabled integrations and add-ons. Describe your actual setup, including relevant processing and storage, rather than copying a claim that only applies to an unconfigured plugin.

Recheck the form after changes to caching, consent tools, security, the form plugin or its challenge integration. Treat comment moderation as a separate surface; our comment spam guide addresses that workflow. The contact-form objective remains specific: reduce unwanted work while keeping a reliable route for legitimate enquiries.