How to Prevent Spam Form Submissions on WordPress and Any Website

The way to prevent spam form submissions is to stack a few defenses that each catch a different kind of bot: a hidden honeypot field, a minimum time before the form can be sent, an invisible check such as Cloudflare Turnstile or Google reCAPTCHA, content filtering such as Akismet, and a rate limit on how often one visitor can submit. On WordPress, most of these are settings inside your form plugin, so they take minutes rather than custom code. Then check the other side of the problem, which is making sure real submissions still reach your inbox instead of your own spam folder.

Why contact forms attract spam

Bots crawl the web looking for any form that sends an email or saves an entry, then fill it with links, fake leads, sales pitches or junk text, and they do it at a volume no person could. A lot of what gets through is offers of backlinks or link swaps, and our post on link exchange in SEO explains why those are worth ignoring. A few manual spammers also fill forms by hand, which is why a puzzle alone rarely stops everything.

The cost is more than annoyance. When a sales inbox fills with dozens of junk messages a day, real enquiries get missed or answered late, form entries pollute your CRM and lead reports, and if the form sends an auto-reply, spammers can use it to send mail from your domain, which hurts your email reputation. Clean lead data matters even more once your forms feed a CRM and automations like the ones in our guide to growth hacking tools.

Anti-spam methods compared

No single method catches everything, so the table shows what each one is good at, what visitors notice and what it costs.

Sources: Cloudflare Turnstile plans, reCAPTCHA v3 docs, reCAPTCHA billing, Akismet and Cloudflare rate limiting rules.

For most small business sites we start with a honeypot plus Turnstile, add Akismet on a paid key if spam that looks human keeps getting through, and add a rate limit only if one source is flooding the form.

Setting it up in WordPress

How you turn these on depends on the form plugin, and the two we see most often on client sites handle it differently.

Contact Form 7

Contact Form 7 supports Akismet, reCAPTCHA and a disallowed list for blocking words and IP addresses (Contact Form 7 FAQ). It also integrates with Cloudflare Turnstile: you create a widget in Cloudflare, paste the site key and secret key under Contact, then Integration, in your WordPress dashboard, and the widget appears on every form, and the plugin’s documentation recommends Turnstile unless you have a reason to use reCAPTCHA (Turnstile integration). If you already use reCAPTCHA, note that Contact Form 7 says Google is moving all reCAPTCHA keys to Google Cloud and that keys must be migrated before upgrading to version 6.1 (Contact Form 7 blog).

WPForms

WPForms turns on its own honeypot-based anti-spam protection by default for new forms, and it adds a minimum time to submit setting that defaults to 2 seconds, country and keyword filters, Akismet, and reCAPTCHA, hCaptcha or Turnstile, all of which work in the free Lite version except its custom captcha (WPForms docs). Old forms may still show a legacy honeypot setting, which is worth updating.

Whichever plugin you use, keep it updated, since form plugins are a common target and updates often close security holes. If you are choosing plugins for a new site, our guide to the best SEO plugins for WordPress covers the rest of the stack.

Checks that happen on the server

Anything that runs only in the browser can be skipped by a bot that posts straight to your form’s URL, so the important checks have to be repeated on the server. With reCAPTCHA, Google’s documentation says your server must verify each token through its siteverify API, and that tokens expire after two minutes, so the check should run when the visitor presses submit rather than when the page loads.

Field validation helps as well. We usually set phone fields to accept exactly ten digits for US numbers and email fields to accept only valid addresses, which blocks a lot of junk and also stops real visitors from leaving contact details nobody can use.

Rate limiting is the last layer. Cloudflare’s free plan allows one rate limiting rule that counts requests by IP address over a 10-second window, which is enough to protect a single busy form or login page from being flooded (Cloudflare). If you would rather not look after the server side yourself, managed WordPress hosts handle security patches for you, one of the trade-offs in our comparison of web hosts for small businesses.

Keeping real submissions out of your spam folder

The second half of the problem is the email your form sends to you. By default WordPress sends mail through the web server, and those messages often fail the checks Gmail and Outlook run, so genuine leads land in spam or never arrive.

• Send form notifications through an authenticated mail service using an SMTP plugin such as WP Mail SMTP, connected to Google Workspace, Microsoft 365 or a sending service.
• Set up SPF and DKIM for your domain. Google requires every sender to Gmail to use SPF or DKIM, and senders of more than 5,000 messages a day to use both plus DMARC (Gmail sender guidelines).
• Send from an address on your own domain and put the visitor’s email in the Reply-To field, instead of putting the visitor’s address in the From field, which fails authentication.
• Submit a test entry every month and after every site update, password change or plugin update, and check that it arrives.

Questions we get asked

Is Google reCAPTCHA still free?

It is free up to a limit, since Google’s billing page gives every organization 10,000 free assessments a month, after which projects without billing get a quota error until the next month and projects with billing pay per assessment, which is one reason many WordPress sites now use Cloudflare Turnstile.

Why am I still getting spam with a CAPTCHA on my form?

Either the bots are posting directly to the form URL and the token is not being checked on the server, or the messages are coming from real people paid to fill in forms. Server-side verification fixes the first, and content filtering such as Akismet or keyword filters handles the second.

Do CAPTCHAs lower form conversions?

Visible puzzles add effort for every real visitor, which is why we prefer invisible methods such as honeypots, Turnstile and reCAPTCHA v3 that most people never notice. Test the form on a phone after any change to make sure it still sends.

Is Cloudflare Turnstile better than reCAPTCHA?

Cloudflare Turnstile is the simpler choice for most small business sites, because it is free for unlimited challenges on up to 20 widgets, works on any website without routing traffic through Cloudflare and rarely shows a puzzle (Cloudflare Turnstile docs). Google reCAPTCHA v3 gives you a score to act on, which suits sites that want finer control, but it is free only up to 10,000 assessments a month.

Does form spam hurt SEO?

Form spam does not hurt SEO when the submissions only reach your inbox or CRM, because Google never sees them. It can hurt when spam gets published on your pages, such as blog comments or forum posts full of links, which Google’s spam policies treat as user-generated spam that can affect how Google handles the site.

An automated SEO score will not tell you about inbox spam, so the monthly test entry described above is still the best check that your forms work.

Is it safe to click links in spam form submissions?

Links in spam form submissions are not safe to click, because many lead to phishing pages, malware or sites that confirm your address is monitored, so treat them like links in a suspicious email. Delete the entry or mark it as spam in your form plugin, which trains filters such as Akismet, and never reply from the address the spammer entered.

If you want to know whether your forms and the rest of your site are working as they should, run our free SEO audit, and see how we build and maintain sites on our web development and website optimization pages.