A contact form is the one part of a small business website that is deliberately open to strangers. That is its job. It is also why it gets hit.
Most sites end up with the same fix — a CAPTCHA bolted on after the spam gets annoying — and it is close to the worst available option. Not because it fails to stop spam. Because of what it does to the people you actually wanted to hear from.
The four defences, cheapest first
They stack. This is not a pick-one list.
1. The honeypot
A form field that is hidden from humans and visible to bots. A person never sees it, so a person never fills it. A naive bot fills every field it finds, and a filled honeypot means the submission is discarded.
Cost to your customers: zero. No puzzle, no delay, no third-party script. It is invisible.
What it stops: the dumb, high-volume, automated end of the problem — which is most of it.
What it misses: anything targeting your form specifically, and anything driven by a real browser.
If you take one thing from this article: turn the honeypot on. It is free, it is built into most form plugins already, and it costs your genuine enquiries nothing. It is the highest-return change on this page.
2. Rate limiting and timing checks
Two variations on the same idea — bots are fast and repetitive.
A timing check rejects a form completed in under a couple of seconds, because nobody types their name, email and message that quickly. A rate limit rejects the eleventh submission from one address in a minute.
Cost to your customers: nearly zero, with one caveat worth knowing. Several people in the same office, or on the same mobile network, can share an outbound IP. Rate-limit by IP too aggressively and you can block a genuine second enquiry from the same business.
3. CAPTCHA
The one everybody reaches for, and the one with a real cost attached.
Every CAPTCHA is a tax on your genuine visitors. Sometimes it is small — a background score with no interaction. Sometimes it is a person on a phone, on mobile data, being asked to identify traffic lights before they can ask you for a quote.
Three things to weigh:
It has an accessibility cost. Image challenges are hard or impossible for some users with visual impairments, and audio alternatives are unreliable. If you serve the public, this matters.
It sends your visitors’ data to a third party. reCAPTCHA is a Google product and it observes your visitors. Under Australian privacy law that is a disclosure you should be making, and most sites running it are not.
Invisible beats interactive. If you use one, use a scoring version that only challenges suspicious traffic. Cloudflare Turnstile is the usual privacy-preserving alternative, and it does not make your customer sort photographs.
The tell that a site got this wrong: a CAPTCHA on a form that receives four enquiries a week. The spam was never the expensive problem there.
4. Content filtering
A service inspects the message body and scores it. Akismet is the long-standing example on WordPress; most premium form plugins bundle something similar.
Cost: a subscription, plus your form content going to a third party for analysis. For a contact form that is usually fine. For a form collecting anything sensitive, think harder — that content is leaving your site.
What it adds: catching the human-written spam that every technical measure above will miss, because a real person typing a real message into your real form breaks no rules.
The order to apply them
- Honeypot. Free, invisible, already in your plugin. Always.
- Timing check. Free, invisible, nearly always.
- Content filtering. When spam gets through steps 1 and 2.
- CAPTCHA. Last. And invisible when you do.
Most sites do this list backwards, starting with the one that costs their customers the most and skipping the two that are free.
Where the plugin routes differ
Free form plugins in the WordPress directory generally include a honeypot and reCAPTCHA support. That covers steps 1 and 4.
Premium tiers add the middle: timing checks, per-form rate limits, country blocking, and bundled content filtering. Whether that is worth an annual licence depends on a number you can actually measure — how many spam submissions you get a week, and how long you spend deleting them.
If the answer is nine and about a minute, do not buy anything. Turn on the honeypot.
The Australian bit
If your form collects personal information — and a name and email is personal information — you should be able to answer where it goes. A form that emails you, stores an entry in your database, syncs to a CRM and passes content to a spam-filtering service has four destinations, and your privacy policy should say so.
The CAPTCHA point above is the one most often missed. If you have embedded a third-party CAPTCHA, your visitors’ data is being shared with that provider on every page it loads — including visitors who never submit the form.
What we would do
On the templates we build, the contact form ships with the honeypot and a timing check on by default, because they cost nothing and they handle the bulk of it. We add filtering when a site actually has a problem, and we add a CAPTCHA when it still has one after that.
If you are drowning in form spam right now, send us what you are seeing — the fix is usually a checkbox somebody never ticked, and we will tell you which one before quoting you for anything.