How to Stop Contact Form Spam on Your WordPress Website

On this page

1. 1. Honeypot fields
2. 2. Time checks
3. 3. Simple questions or invisible challenges
4. 4. Validation
5. 5. Server-side checks
6. 6. Anti-spam services and filters
7. What to avoid
8. Test after changes
9. Real example

Spam submissions waste time and can bury real enquiries. The goal is to block bots without making the form harder for genuine customers. Here are the methods that work, from least to most intrusive.

1. Honeypot fields

A hidden field that people can't see but bots fill in automatically. Any submission with it filled is discarded. It's invisible to real users and stops a large share of simple bots.

2. Time checks

Bots often submit forms within a second of loading the page. Rejecting submissions sent unrealistically fast blocks many of them with no impact on people.

3. Simple questions or invisible challenges

A basic question (like a simple sum) or an invisible challenge service stops more determined bots. Prefer options that don't make people solve frustrating puzzles, especially on mobile.

4. Validation

• Require valid phone number and email formats
• Limit message length
• Block submissions containing lots of links, a common spam pattern

5. Server-side checks

Client-side checks can be bypassed, so important checks (like the honeypot) should also be verified on the server that processes the form.

6. Anti-spam services and filters

Spam-filtering plugins and services analyse submissions and flag likely spam. Keep a spam folder to review occasionally, so real enquiries aren't lost.

What to avoid

• Hard CAPTCHAs that frustrate real customers and cut submissions
• Blocking whole countries if you might get genuine international enquiries
• Filters so strict that real messages vanish silently

Choosing a form plugin? See WordPress form plugins compared.

Test after changes

After adding spam protection, submit the form yourself on desktop and mobile and confirm the email arrives. See why contact forms stop getting enquiries.

Blog comment spam is a similar problem; see should a business site enable comments?

Real example

This website's contact form combines a hidden honeypot field, a time check and a simple maths question, with the honeypot also checked on the server, as described in the Samverse case study.