Spam and bot protection

Why forms attract it

Automated software crawls the web looking for forms and submits to all of them. It is not targeted at you and it does not stop, which is why every public form receives some.

The volume varies with how easy your form is to find and how long it has existed. A form on a site that has been up for years collects more than a new one.

Almost all of it is automated. That matters because automated submissions are distinguishable from human ones in ways a visitor never has to notice.

It also means the volume is not a judgement on your site. A form receiving spam is a form that exists publicly, and nothing about your business attracted it.

Invisible defences first

A hidden field that humans cannot see and bots fill in catches a large share on its own. Anything arriving with that field completed is discarded.

A minimum completion time catches most of the rest. A form submitted under a couple of seconds was not typed by a person reading it.

These cost a visitor nothing because they never encounter them. That is why they belong first rather than as a supplement to something visible.

Most website tools include both already. Check whether yours does before adding anything, because a defence you switch on is a genuinely useful minute and a defence you install is a new dependency.

The cost of visible challenges

A puzzle in front of your contact form is friction applied to everybody, including the customer ready to call you. A share of them simply stop.

They are also an accessibility problem. Image-based challenges exclude people who cannot see them, and audio alternatives are frequently unusable in practice.

Our page on accessible forms covers the requirement. The honest position is that a visible challenge is a last resort, not a default.

The cost is also invisible to you. Somebody who abandons a puzzle does not send a message explaining why, so the defence looks free while it quietly works against the point of the form.

The defences worth having

The list below is ordered from invisible to intrusive. Work down it only as far as your actual spam volume requires, and no further.

• A hidden field bots complete and humans cannot see
• A minimum time before a submission is accepted
• Filtering on the server, not in the browser
• Rate limiting from a single source
• No email address published anywhere on the site
• A modern invisible challenge, if needed
• A visible puzzle, only as a last resort

Keep email addresses off the page

A published email address is harvested automatically and permanently. Once collected it is traded, and no filtering afterwards undoes that.

Direct every communication route through the contact form instead. It keeps the address private, gives you a consistent record, and removes the harvesting problem at the source.

Our page on contact pages covers doing that without looking evasive, which is the reasonable objection to it.

A phone number can stay visible. Numbers are harvested far less, and a business that publishes one alongside a form reads as reachable rather than as hiding behind a box.

Filter, do not block

Route suspected spam somewhere you can still see it rather than discarding it. Every filter has false positives and a discarded genuine enquiry is invisible by definition.

Look in that folder occasionally. A real customer writing in unusual English, or a short message that reads like a template, is exactly what a filter gets wrong.

Our page on contact forms covers keeping a record inside the platform as well, so an enquiry lost in email is still recoverable.

Measure before adding friction

Count what you actually receive for a month. Small businesses frequently add heavy defences against a problem of a handful of messages a week, which is not worth a single lost customer.

If the volume is low, the invisible defences and a filter are sufficient and nothing visible is warranted.

If it is genuinely high, add a modern invisible challenge before a visible one. The ordering matters because the cost falls entirely on real visitors.