Website Forms and Spam: Keeping Your Enquiries Clean

Contact and enquiry forms are often the most valuable part of a small business website. They are also a favourite target for spam bots. When the inbox fills with junk, real enquiries get missed or delayed. The good news is that most form spam can be cut down with a few layers of protection that do not make life harder for genuine visitors.

Why forms attract spam

Automated scripts crawl the web looking for forms they can submit. Some try to post links to dubious sites, some test stolen card details, and some simply fill every field with nonsense. A form with no protection at all will usually start receiving junk within weeks of launch.

Layer your defences

No single method stops everything. Combining several light measures works better than one heavy barrier.

Use a honeypot field

A honeypot is a hidden field that real visitors never see or fill, but many bots do. If the field contains anything when the form is submitted, the submission is quietly discarded. It costs visitors nothing and catches a surprising amount of simple spam. Make sure the field is hidden in a way that screen readers also skip, so it does not confuse people using assistive technology.

Check timing

People take at least a few seconds to read and fill a form. Bots often submit instantly. Recording when the form loaded and rejecting submissions that arrive impossibly fast is another invisible filter.

Validate on the server

Checks in the browser are helpful for visitors, but bots skip them. The server should check every submission too: required fields present, email addresses in a valid format, phone numbers containing digits, and message length within sensible limits. Rejecting messages stuffed with many links is often worthwhile, since genuine enquiries rarely contain more than one or two.

Limit repeated submissions

Rate limiting means refusing too many submissions from the same address in a short time. It prevents a single bot from flooding the inbox and also protects your server and email account.

Consider a CAPTCHA, carefully

CAPTCHAs can block determined bots, but puzzles that ask people to pick traffic lights also put off real customers, especially on mobile. Newer invisible or low-friction options, such as Google reCAPTCHA v3 or Cloudflare Turnstile, score visitors in the background and only challenge suspicious ones. If you add one, check that it does not slow down the page or block legitimate users, and mention it in your privacy notice where required.

Keep fields to a minimum

Every extra field is more effort for real people and more surface for abuse. Name, a contact method and a message are enough to start most conversations. Ask for the rest later.

Make sure real enquiries arrive

Spam protection is only half the job. The other half is making sure genuine messages reach you reliably.

• Send form emails through a proper email service or authenticated SMTP rather than the server's default mail function, which is often marked as spam.
• Set up SPF, DKIM and DMARC records for your domain so your own messages are trusted.
• Store submissions in the website's database as well as emailing them, so nothing is lost if email fails.
• Test the form after every update by sending yourself a message.

Watch for warning signs

A sudden jump in junk usually means bots have found a gap. Silence can also be a warning: if enquiries drop to zero, the form or email delivery may be broken. Check monthly that submissions are arriving and look sensible.

Protect privacy

Forms collect personal details. Use HTTPS, avoid storing more than you need, limit who can see submissions, and delete old entries you no longer require.

Getting it set up

Most of these measures take a developer a short time to add to an existing site. If your enquiries are drowning in spam or going missing, the team at creworktech.in can review the form and email setup as part of their website work, but even adding a honeypot and server checks yourself will make a visible difference.