How to stop contact form spam without losing real enquiries

Where does contact form spam come from?

Most contact form spam comes from bots that find forms automatically and fill in every field they see, and the rest comes from people paid to paste sales pitches into forms by hand. The two need different defences. A bot trips over hidden fields and timing checks, while a person typing an SEO offer passes every CAPTCHA because they are a real person.

That is why Contact Form 7's own documentation advises using two or more of its spam modules together. One layer catches the bots quietly, and a second one looks at what was written. Neither should stand between a real customer and the send button for longer than a second.

Which anti-spam methods cost real visitors the least?

Hidden checks that the visitor never sees cost the least: a honeypot field, a time trap and an invisible challenge such as Cloudflare Turnstile. Puzzles and blocklists catch more in some cases, but each one risks turning away a customer who was ready to buy.

For most small business sites, a honeypot and a time trap stop the bulk of bot spam on their own. Add Turnstile if bots still get through, and Akismet or a short keyword list if hand-typed pitches are the problem.

Be wary of image puzzles in particular. They are hardest for people with poor eyesight and for anyone squinting at a small phone screen, and a customer with a burst pipe has little patience for picking out traffic lights. If you do use a visible CAPTCHA, put it only on the form that gets the spam, not on every form on the site.

How to set it up in Contact Form 7, WPForms and Gravity Forms

All three have a free invisible check, built in or as an add-on, and each can keep suspected spam for you to review, though Contact Form 7 needs its companion plugin for that.

Contact Form 7

Contact Form 7 has a Cloudflare Turnstile integration under Contact → Integration, where you paste the site key and secret key; it adds the widget for you. Its reCAPTCHA integration uses v3 only, and treats a score under 0.50 as spam by default. It also supports Akismet and WordPress's disallowed list of words and IP addresses. The plugin doesn't keep messages itself, so install its companion plugin Flamingo if you want a record: Flamingo shows held messages with the reason they were marked as spam. If the problem is that genuine messages never arrive, see Contact Form 7 not sending email: a checklist.

WPForms

In the form builder, open Settings → Spam Protection and Security. The modern anti-spam protection (a honeypot-based check) and a minimum time to submit are there, along with an option to store spam entries so you can review them, plus country, keyword and email filters. reCAPTCHA, hCaptcha and Turnstile are available on every licence, according to WPForms' documentation. For notification problems rather than spam, see WPForms notifications not sending.

Gravity Forms

Open the form's Settings → Form Settings and find the Spam Detection box. Turn on the honeypot and choose Create an entry and mark it as spam instead of "Do not create an entry", then add the Submission Speed Check. The Akismet, Cloudflare Turnstile and reCAPTCHA add-ons come with every Gravity Forms licence. Held entries appear under the form's Entries, in a separate Spam tab.

What's a sensible set-up for most small business sites?

Start with the checks visitors can't see, and only add more when real spam still gets through.

1. 1

   Turn on the hidden checks

   Switch on your form plugin's honeypot and minimum time to submit. They cost real visitors nothing.

2. 2

   Hold spam, don't delete it

   Pick the setting that keeps suspected spam in a separate folder or tab instead of rejecting it outright.

3. 3

   Add Cloudflare Turnstile if bots still get through

   Create a widget in your Cloudflare dashboard, choose Managed mode and paste the two keys into your form plugin.

4. 4

   Deal with hand-typed pitches separately

   Use Akismet or a short list of words that only spammers use, such as the names of the services they sell.

5. 5

   Send yourself a test

   Fill in the form as a customer would, from your phone as well as a computer, and check it arrives.

Why should you hold spam instead of deleting it?

Every filter gets some real enquiries wrong, and a deleted enquiry can't be recovered or answered. A customer who pastes a link to a photo of their leaking boiler looks a lot like a spammer to a link filter. So does someone on a VPN, someone who fills the form in very quickly from autofill, or someone writing about "backlinks" because that's their business.

Shopify works this way by default: its contact form still delivers messages it thinks are spam, with [SPAM] at the start of the subject, so you can filter them instead of losing them. Do the same with your form plugin. Then check the held folder once a week, and if you find a real enquiry in it, look at why it was caught and loosen that one rule.

Real enquiries in a spam folder tend to give themselves away. Look for:

• a full name with a local phone number or postcode

• a reply to a quote or email you sent

• your own town, products or services mentioned by name

• a short, slightly awkward message with no links at all

Spam in your form plugin's folder is a different problem from your form emails landing in your mail provider's spam folder. That one is about email authentication, covered in WordPress form emails going to spam.

How does Formcrier's spam filter work?

Formcrier, which sends each form submission to your phone, has its own spam filter for each site that looks for a filled-in trap field, a form sent within 2 seconds of the page loading, several links, common spam phrases and repeat submissions. On the Normal level it holds a submission when a trap field was filled in or two of the other signs appear together; Strict holds on one sign alone. Spam is saved but nobody is alerted, it doesn't count towards your plan, and pressing Not spam sends the alert straight away. The details are in Spam and limits.