You have a shiny, gorgeous website, sparkling away to the universe, and with a juicy contact form temptingly enticing potential clients or customers to get in touch.
While having a great contact form does attract some fantastic potential clients, it also acts as a bright light on your porch at night – it attracts every spammer, scammer and SEO snake-oil merchant in a million-mile radius.
Before you know it, your email inbox is filled with offers to visit sites where people don’t wear very much, and all seem to have breathing difficulties; places to buy cheap sunglasses; and people trying to tell you that you are missing out on customers and if you only let them do their SEO hocus-pocus you will be top of some vaguely defined heap.
You may also find your site becomes unstable as it goes up and down as the spambots hit your site with thousands of responses that overwhelm your hosting account.
In this post, we will take a look at different sorts of website contact form spam, before looking at a few ways you can stop, or at least significantly reduce, the flood of spam in your in-box.
Why Do Spammers Spam?
Short answer: Money. Spammers spam because either they are paid to spam, they are driving traffic to a site that generates money for them, or they want to use you as an unpaid spam assistant.
Spammers know that email filters now filter out many spam emails, so they had to find another way to get to you.
Want to know more about spam emails? Here’s an article to help you work out if your emails are classed as spam under Australian laws.
Emails from contact forms usually get through the spam filters and are read by the business owner in case they are a valid lead. So, spammers use this strategy as a way to get their message in front of you.
One key thing to remember: Always assume if you click on any link in a contact form response that it will fill your site with malware. Treat every link as if you are trying to kiss a cobra – with high suspicion and a whole lot of nope.
Contact form spam messages may be one of a few different types:
Sending you to adult sites. If you click on a link, you may be presented with a captcha image before you view. What you may not know is that the image may be pulled from a different site the scammers are trying to access, so you have become unpaid assistant to the spammer.
Sending you to product sites. These promote a range of products from fake designer handbags through to products that seem vaguely related to your business, such as business cards or office furniture. Remember that no reputable company would stoop to contact form spam, so treat their offer with extreme caution.
SEO/Web design/Marketing services. SEO companies that try to make you think you are missing out on traffic, or have things broken on your site that only they can fix, are a scourge on society and are emails you can instantly delete without a second thought or response.
An easy to remember rule is if the SEO company has any skills at all, they will not use contact form spam; they would be ranking in Google when you searched them. If they spam you – bin them.
The same with all the four billion web design companies offering to fix things at really cheap rates. Treat them with the same amount of caution as getting a backyard doctor who only charges $5 to give you a boob job. If a web designer uses your contact form to tout for your business, then you can happily ignore them and look for more reputable web designers.
We are also seeing an increase in contact form spammers using contact forms to try and tout for business. Can I get a “Hell No!”
Junk. You may get contact form contents that make no sense at all. The words (if you call them that) are all jumbled, and there are no apparent links. What gives?
In this case, they are hoping that your contact form emails them back with confirmation of what they submitted. Why? So they can get your email address, which they can then use in their spamming campaigns.
This isn’t just a matter of domain name hijacking, where they pretend the email is from you, they may also be probing your form for vulnerabilities that they then exploit to use your website server to send out their spam emails to thousands of people, leaving you with the blame and blacklisted site.
Here’s some ways to help protect your website from hackers.
Different Types of Contact Form Spammers
Just as your favourite tin of spiced ham now comes in different flavours (Spam classic for you purists, Spam Lite, Spam Ham with REAL bacon etc.), contact form spammers also have different types.
Spambots
These are the most common causes of contact form spam and are machine-driven bots that crawl the internet looking for unsuspecting contact forms to ravish. When they pounce on a contact form, the bot quickly fills in the requisite fields, usually with a false email address, and drops their message payload into your comment field.
But don’t feel special in your ravishment. Spambots can ravish millions of websites in a day, so you are just a number to them.
These bots are often driven by artificial intelligence, so they learn what works and doesn’t work with different types of forms, and then adjust their approach accordingly.
That’s why spambots can now get around many of the strategies we used in the past to minimise spam – they have learned the tricks of the trade.
Most of my clients have seen a dramatic increase in spam attacks in the past six months, as the bots have found their way around even the most robust strategies we had in place. Keeping spammers at bay is a constant war.
Human spammers
Then there are the human spam spiders, often in third-world countries or third-world Australian businesses, who search the internet and then copy and paste their poison into your contact forms. Because these spammers are human, they can get around most of the tech solutions that stop the bots.
These blights on society will generally always get through to annoy you, and short of hiring a hit-man to take them out, they are one of the crappy parts of doing business.
Ways To Stop Spam From Your Contact Forms
To reduce spam from your contact forms, we recommend starting with some of the free options and then if spam persists, adding in a paid strategy.
Free Options:
1. Disable contact form autoresponders
Turn off all autoresponders that send people a confirmation email about what they submitted. Either take the person to a thank you page on your website, or display a thank you message, but never use an autoresponder.
2. Rename your fields
Bots are programmed to look for fields such as name, email, comment. You can try renaming your fields to something more obscure to try and trick the bots. Just be sure to test that you still get the full information from your form if you try this strategy.
3. Add a unique quiz/comment field
Create a mandatory field to have people answer a random question. This works well for reducing bots but won’t stop human spammers.
e.g. Which is bigger – 2 or 7? Only allow responses with the number 7 to be sent through.
What is your favourite word? We use that one on our website contact form and is a fun way to continue your branding throughout all parts of your site.
4. Add reCAPTCHA 3
Google hates spam as much as you do, so it has a free product called reCAPTCHA. You need to add in some code that you generate through this product to your website.
First, a quick CAPTCHA history. Early attempts to stop spammers with CAPTCHA had you trying to decipher random words that appeared in a wavy format. Unless the person was high or drunk, most people took several goes to work out what the words were.
We then moved onto picking images from a series of photos from Google street view: Click on the mountains, or bicycles. Again, it could be tricky (and super annoying) and after a few rounds of spot the stoplight I usually wanted to shove the said stop lights up the web designer’s unmentionables.
You could also have people complete a maths quiz – which worked well if you had a calculator, but now the bots can do that faster than a human, which sort of defeats the purpose.
We then moved into the era of ticking the “I am not a robot” box in reCAPTCHA2. It worked … for a time, but spammers are now merrily getting past that one as well.
In reCAPTCHA3, the “thing” is invisible to humans, but tricks bots.
What we have found is that adding reCAPTCHA3 has slowed the contact form spam on the sites we have added it to, and It works well except for human spammers and really advanced bots. For those sites that continue to be pestered, we needed a stronger solution.
We also found that not all plugins play nicely with reCAPTCHA3.
For example, some of our critical plugins from Easy Digital Downloads that we use to run our sister company, the Employee Manual website, don’t allow reCAPTCHA3 – only version 2.
One thing to know before trying to add reCAPTCHA3 is that Google REALLY sucks at giving information on how to use its products, so use one of the below tutorials that walk you through how to get your API keys with Google, and then where to put them in your contact form plugins.
How to add reCAPTCHA v3 to your contact form
There are loads of different contact form types on the market, but we will talk about three of the main ones: Divi, Contact Form 7 and Gravity Forms.
Don’t use these forms? There are many plugins in the WordPress repository that can help. With all plugins before you install one, look to see the number of installations, that it has been updated in the past six months and that it is compatible with the latest version of WordPress.
5. Add a Honeypot
Think of a certain bear named Pooh and honeypots and you get the idea of what we are talking about.
A honeypot is a fancy bit of code that is invisible to humans but bots are drawn to and can’t help themselves trying out. Which then triggers the “No Spammers Welcome Here” sign and slams shut all bits to your contact form.
Not all forms offer a honeypot built into their code, but they are worth adding if you can.
- Honeypot for Contact form 7 (an additional plugin)
- Gravity forms honeypot (instructions on where to find it in the settings)
Paid Option
6. Add a paid Spam Screening plugin
If the slime bucket human and advanced bot spammers are getting out of hand, and are still getting around reCAPTCHA3 option, you need to go with a paid scanning option.
There are two that we recommend (for now): CleanTalk and Akismet.
CleanTalk
CleanTalk has a plugin that you can add to stop spam on your contact form, comments, registrations, orders, bookings and subscriptions. They offer a free seven-day trial and then it only costs $8US per year to continue to use it.
When someone fills in a form on your site, their details are compared to Cleantalk’s database and then marked as OK or are blocked.
There are no quizzes or boxes to tick. Your visitors see nothing. It also works well on Easy Digital Downloads!
We found Cleantalk easy to set up and configure, but it has a few quirks:
- Remove or disable any other reCAPTCHA plugins/settings before activating Cleantalk.
- Remove or disable any other anti-spam plugins you have running. We use Antispam Bee to stop spam comments on many of our sites. It works well for comments but not for contact forms.
- When you use the email they recommend to test that your form is working, expect pages on your site to suddenly disappear from your view. What happens is that one of their defensive strategies is to make page contents disappear from suspected spammers. As I was adding and testing the form on several sites, my IP address was recorded as a suspected spammer and my world suddenly went blank. It caused a very nervous half an hour until I figured out what happened.
How to Install CleanTalk
CleanTalk try to make it as easy as adding in and activating a plugin.
Start by logging into your website and then go to Plugins – Add New. Type Cleantalk in the box that says Search plugins.
Next, Click on Install Now and then Activate the CleanTalk Plugin.
Then choose whether you want your CleanTalk account to be set up with one click, with the email being the email admin account for your website they show. If so, then click the Get Access Key Automatically button.
If you want to set up your account under a different email address, click the plugin HomePage link on the righthand side, and follow the instructions to get your access key.
Click save – and that’s it!
Remember to check your CleanTalk dashboard regularly to make sure there have been no false positives (where contact form entries have been marked as spam, but they were valid). So far, we have had no false positives from CleanTalk.
Akismet
Akismet is the granddaddy of all spam plugins and comes pre-installed on all WordPress sites. Many many moons ago it used to be a free service. Now if your website is a business site, then you are up for $7AU per month. The free option is only for personal websites – if you sell/promote anything, then you have to stump up the $ to get Akismet.
While it is a useful plugin, we have found signing up for plans (especially if you have several websites) cumbersome, and a bit tricky at times. We have also found that it can quickly fill up your database with stuff, and often has false positives. Cleantalk is cheaper and works just as well in our experience.
Last thoughts
Contact form spammers don’t have morals or consciences: They are merely following the money, and while there is money to be made finding ways to spam you, they will do so. This means they are always investing in new ways to get around any spam blocks on your contact forms that you put in place.
For now, in 2020, your best options are reCAPTCHA3 and one of the paid spam screening services. Next year may be a totally different spammy ballgame.
FAQs
Why is my website contact form getting spammed? ›
The reason is, spambots trolling websites looking for web forms to submit also seek out email addresses they can harvest and use as a way to spam others. Of course, you can always fight spambots using a WordPress plugin like Email Address Encoder to protect your email addresses and mailto links.
How do I stop bots from filling out forms? ›- What is a spambot? ...
- Use a CAPTCHA. ...
- Use a double opt-in form. ...
- Add a test question to your form. ...
- Add an unseen extra field or honey-pot. ...
- Block Comment Spam. ...
- Spam signups can mess up your lists.
WPForms is the best form spam prevention plugin.
You can add captcha to your contact forms. Or even better, you can use one of the more user-friendly reCAPTCHA alternatives available in WPForms. You don't need to install any extra anti-spam plugins.
- 1. “ ...
- “Secure contact forms using a double opt-in form.” ...
- “Add a test question to your contact form.” ...
- “Add Honeypots.” ...
- “Implement time-analysis.” ...
- "Hide target request." ...
- "Form validation after geolocation of the IP address." ...
- Use a web application firewall.
You can provide additional protection against spam form submissions by enabling CAPTCHA on your form or blocking specific email domains and free email providers.
How do I stop a website from spamming? ›- Change direct emails addresses on your website.
- Use reCAPTCHA from Google on your website.
- Make sure your domain is private.
- Add a hidden field to your forms.
- Add commands to your . htaccess file.
- Block unnecessary countries from accessing your website.
Blacklisting IPs: This is the most simple and common method to block spambots but till that damage has been done. To stop the further damage you can blacklist the IP or series of IP on the firewall, so no more spamming is done.
Can you stop a bot from crawling a website? ›They can do this by utilizing robots. txt to block common bots that SEO professionals use to assess their competition. For example Semrush and Ahrefs. This will block AhrefsBot from crawling your entire site.
How do I get rid of bots on my website? ›By far the easiest way is to go to View Settings in the Admin section and simply check the “exclude all hits from known bots and spiders” option. NOTE: Checking this option will only remove bots from new data starting from the point the box is checked onward.
Do contact forms on websites work? ›A contact form is a short web-based form published on a website. Any visitor can fill out the form and submit it to send a message to the site owner. Behind the scenes, your contact form triggers an email message to be generated and sent to your email inbox.
How do I block spam contacts? ›
- On your device, open the Phone app .
- At the bottom, tap Recents .
- Tap the call you want to report as spam.
- Tap Block or Report spam.
On an Android phone, you can disable all potential spam messages from Google's Messages app(Opens in a new window). Tap the three-dot icon in the upper right of the app and select Settings > Spam protection and turn on the Enable spam protection switch.
How do you add validation to contact form? ›In Contact Form 7, a user-input validation is implemented as a filter function. The filter hook used for the validation varies depending on the type of form-tag and is determined as: wpcf7_validate_ + {type of the form-tag}. So, for text form-tags, the filter hook wpcf7_validate_text is used.
How do I secure a contact list? ›Press the "Menu" button on your Android phone and tap "Settings" from the list of options. Select "Location and Security," followed by "Set Up Restriction Lock." Tap "Enable Restriction Lock." Enter a password for the lock in the appropriate box.
How do I make a contact form secure in HTML? ›For security reasons, ensure your HTML contact form uses an SSL certificate or is embedded on a secure web page. You should also consider CAPTCHA, as it will prevent spammers from abusing your form with bots. That's all it takes to generate simple, fully functional HTML code for contact us forms.
Why do spam bots fill out forms? ›Competitors use bots to regularly spam contact forms on such sites to generate fake leads, which end up irritating advertisers as well as the site's sales teams who then must comb through all the spam to find real leads.
How do I block a form submission? ›We can stop the form from submission by giving the "return false;" value to the onsubmit event. Giving this value to the event makes the form return nothing and prevent it from submission as well as refreshing the browser.
How do I filter spam in Contact form 7? ›Goto contact tab and Edit any CF7 form and click on Antispam Settings tab. Add the emails, email's domain and/or and/or words and phrases as comma seperated values that you want to block. Enter the message to be shown to the spammers or bots in 'Set your error message' field.
How do I stop being bombarded with spam? ›- Report the email as spam.
- Block spam email addresses.
- Change your email privacy settings.
- Unsubscribe from unwanted newsletters or mailing lists.
- Use a secondary email address.
- Use a third-party email filter.
- Delete suspicious emails.
- Protect your device against malicious spam.
Visit the site you want to block. Click on the BlockSite icon located at the top right corner of your browser. Click the Block this site button to restrict access to the website.
How do I automatically delete spam forever? ›
Go into the Filters and Blocked Addresses tab. Click Create a new filter. Fill out the details and click Create filter. Check the Delete it option and Also apply filter to x matching conversations to delete already existing emails.
How do I permanently delete spam? ›A: Ideally, items deleted from your Junk folder should be permanently deleted when you instruct the email program to do so. This typically happens when you right-click over the items in the folder, or over the folder itself, and select either "Delete Permanently" or "Empty folder" when prompted.
What is the difference between bots and spam? ›A spam bot is a specific type of bot that sends (or helps with sending) spam messages. A spam bot may also post spam in various places where users interact online, such as social media platforms or forums. Spam is any inappropriate or unwelcome message that's pushed out to a large number of users.
How do you tell if a bot is crawling your site? ›If you want to check to see if your website is being affected by automated traffic, then the best place to start is Google Analytics. In Google Analytics, you'll be able to see all the essential site metrics, such as average time on page, bounce rate, the number of page views and other analytics data.
Why are bots coming to my website? ›Commercial bots: Commercial companies send these bots to crawl the web to gather information. For instance, research companies use them to monitor news on the market; ad networks need them to monitor and optimize display ads; 'coupon' websites gather discount codes and sales programs to serve users on their websites.
What is bot crawling? ›What is a web crawler bot? A web crawler, spider, or search engine bot downloads and indexes content from all over the Internet. The goal of such a bot is to learn what (almost) every webpage on the web is about, so that the information can be retrieved when it's needed.
What does bot traffic look like? ›Unusual traffic spikes
If your website normally gets 1,000 visitors per day and one day you get 20,000 visitors without doing anything different from a sales or marketing perspective, this is most likely bot traffic.
Bot filtering is a feature of analytic programs and tracking platforms that track and filter unwanted traffic. Tracking algorithms are designed in such a way that even the smartest bots can be calculated.
How do you stop bot detection? ›- IP Rotation / Proxy.
- Disabling the automation indicator WebDriver Flags.
- Rotating HTTP Header Information and User Agent.
- Avoid Patterns.
- Remove JavaScript Signature.
- Using Cookies.
- Follow The Page Flow.
- Using a Browser Extension.
Contact Forms Offer The Best User Experience
Having a contact form on your website can optimize user experience in a multitude of ways. Contact forms are an efficient way to encourage users to interact with your site, offering the most streamlined means of communication.
Should I have a contact form on every page of my website? ›
Get More Leads With Contact Forms
Every page on your website needs a way to guide visitors through the process toward becoming happy customers, no matter what industry you're in. Whether you're… …it's important to encourage visitors to take the first step in their customer journey.
More trust. Various marketing studies have shown that users trust emails more than contact forms. Because they are sure that the company will answer them for sure soon and the answer will not be lost. In addition, such communication is more personal.
How do I protect a contact form from spam in WordPress? ›- Use reCAPTCHA.
- Use a Custom CAPTCHA.
- Use Invisible reCAPTCHA (Aka No CAPTCHA)
- Use the Honeypot Antispam Method.
- Use WordPress Antispam Plugins.
- Block Copy and Paste in Your Forms.
- Block Traffic by IP Address.
Your best step is to block the text sender—don't click any links!—and report the spam. Then, delete the text from your phone. Silence is always the best policy. Never respond to spam texts, not even with “stop.”
Is there a good spam blocker? ›Robo Shield Our top pick for spam blocking. Robo Shield combines an array of phone security features to create a holistic spam blocking and phone security approach. Truecaller Best free option. Among the most-used free spam blocking apps on the market with a large number of useful features.
What is best free spam blocker? ›| Name | Device Support | Free Trial/ Refund |
|---|---|---|
| YouMail | Android and iOS | Lifetime Free Basic Plan |
| Truecaller | iOS and Android | Lifetime Free Basic Plan |
| Nomorobo | Android and iOS | Yes, 14 Days |
| Robokiller | iOS and Android | Yes, 7 Days |
- Step 1: Create a form so users can subscribe to your messages. ...
- Step 2: Add a hidden field to your form as a decoy for bad actors. ...
- Step 3: Add the form to your site and hide your decoy field. ...
- Step 4: Capture and view the form field. ...
- Step 5: Use segments to filter out spam users.
Go to the admin menu Contact > Integration. Find reCAPTCHA panel and click Configure Keys. Copy the site key and secret key into the fields and save them.
How do I add a Captcha to a contact form? ›...
Set up reCAPTCHA in a Contact Form or Subscribe Form module:
- Open either module for editing and click the Captcha tab.
- For the reCAPTCHA field setting, click Show.
- For Validate type, choose the validation type you want.
Once hackers have your number, they can use it to gain access to your most sensitive and valuable data, such as your: Email accounts and contact lists.
How do I clean up my contact list? ›
- A single contact: Tap the contact. At the top right, tap More Delete. Delete.
- Multiple contacts: Touch and hold a contact and then tap the other contacts. Tap Delete. Delete.
- All contacts: At the top right, tap More Select all Delete. Delete.
For those who are unfamiliar, an encrypted secure form (or HIPAA-compliant contact form) is a form that is encrypted at all times and presented in a simple, single line of HTML code to ensure that any information submitted using the form is fully encrypted and federally compliant from end-to-end.
How do I protect my contact form 7 from spam? ›Step #1: Edit any CF7 form and click on Antispam Settings tab. Step #2: Add the emails, email's domain and/or and/or words and phrases as comma seperated values that you want to block. Step #3: Enter the message to be shown to the spammers or bots in 'Set your error message' field.
Why is my website contact form not working? ›There are many reasons why a form might appear not to work from issues as simple as a typo in the submissions notification email address to issues with your webserver not being allowed to send emails, to issues with code on your website.
Why are my contact form 7 emails going to spam? ›Emails sent from Contact Form 7 can be considered spam for a number of reasons, and get rejected at many points during the email sending and receiving process, in addition to your spam folder. This is usually due to the From: email address used or email content.
Does Akismet work on contact forms? ›Yes, Akismet integrates with popular contact form plugins like WPForms to block spam submissions. WPForms is the best WordPress Form Builder plugin. Get it for free! Akismet is one of the best alternatives for reCAPTCHA.
Do people use contact forms on websites? ›That's where contact form comes into the stage. It's a great and easy way for letting people know that you are reachable directly through the contact us form that you use on your website. Another advantage of contact forms is to give the impression that you're always there to get their message.
Should you have a contact form on your website? ›The main benefit you get from a contact form is automating responses to questions from site visitors and looking professional. In addition, the contact form shows the potential customers that they are essential to you and that you are open to questions. It shows that you are a true professional and you can do business.
Should you have a contact form on every page? ›Get More Leads With Contact Forms
Every page on your website needs a way to guide visitors through the process toward becoming happy customers, no matter what industry you're in. Whether you're… …it's important to encourage visitors to take the first step in their customer journey.