Blog post overview and metadata
Author, publish date, read time, and category
Stopping Contact Form Spam Without Losing Real Enquiries
Reviewed by: ARS Developer Team | Updated: 30 Sep 2026 | UK Focus: Buyer-intent SEO, web delivery, and measurable conversion growth.
Quick Summary
Every anti-spam measure blocks some genuine visitors. Here is how to cut the noise while keeping the enquiries you actually want.
In This Guide
Why This Article Is Trustworthy
- Reviewed by the ARS Developer editorial team for UK business relevance.
- Structured around buyer-intent SEO, technical delivery, and measurable conversion outcomes.
- Connected to related service pages, pricing guidance, and supporting articles for stronger topic depth.
Quick Answer
Most form spam is automated and can be removed with techniques the visitor never sees. Reach for a CAPTCHA last, because it is the measure that costs you real enquiries — and the people it turns away are disproportionately those using assistive technology or an older device.
Invisible defences first
A honeypot is a field hidden from people and visible to simple bots; anything that fills it is discarded. A timestamp check discards submissions completed in under a couple of seconds, because nobody reads and completes a form that quickly. Together these remove a large share of automated submissions and cost a genuine visitor nothing.
Hide the honeypot with CSS rather than the hidden attribute, and label it so a screen reader announces it as one to leave blank. A field that is invisible to everyone including assistive technology will catch the people you least want to block.
Rate limiting handles the rest of the volume
Spam arrives in bursts from a small number of sources, so limiting submissions per address over a window removes most of the volume without touching a normal visitor, who submits once. Laravel has this built in; most other frameworks do too.
Set the limit generously — several submissions an hour rather than one a day — because shared office connections and mobile networks put many people behind one address. A limit tight enough to catch every bot will eventually catch a customer at a co-working space.
CAPTCHAs are a real cost, so use them last
Image challenges are difficult for people with visual impairments, for some people with dyslexia, and for anyone on a slow connection. Invisible scoring systems are better, but they still occasionally challenge legitimate visitors, and they add a third-party script and a consent question to every page they appear on.
If you do need one, put it only on the forms that are actually attacked, keep the threshold forgiving, and make sure a failed challenge gives the person another route to contact you rather than a dead end.
Check what you are actually catching
Any filter will misclassify something, so for the first month keep rejected submissions rather than discarding them. Read through them weekly. The genuine enquiry sitting in that list is what tells you the threshold is wrong, and it is the only way to find out — a blocked customer does not usually try again.
It is also worth confirming the notifications reach you at all. A form that works perfectly and emails into a spam folder produces the same symptom as one that is broken, and it is a more common cause than it should be.
Frequently Asked Questions
Does a honeypot still work?
Against the bulk of automated submissions, yes. It will not stop a targeted attack, but most form spam is indiscriminate.
Are CAPTCHAs an accessibility problem?
They can be. Image and audio challenges create real barriers, which is why they are better used as a last resort on the forms that need them.
Why did spam suddenly increase?
Usually because your form was discovered by a crawler. A change to the field names and the addition of a honeypot often ends it.
Should rejected submissions be stored?
For a short period, yes, so you can confirm nothing genuine is being caught. Then they should fall under the same retention rules as everything else.
Next Step
If your enquiry form is either full of spam or suspiciously quiet, both are worth checking. Get in touch and we will look at how it is set up.
Next Step Resources
Move from research into action with the most relevant service, proof, pricing, and project planning pages for this topic.
Tags:
Leave a Comment
Ask a practical question, share a project insight, or add a useful note. Every comment is reviewed before it appears publicly.