The website form sends you forty messages a day: link lists in Russian, "I can get you to page one of Google", crypto offers, blank names with random letters. Somewhere in there is the one customer who wanted a quote, and you missed them. Most of this is bots that find the form and post to it directly; the rest is people paid to paste sales pitches. Each kind has a different fix, and the right fix stops nearly all of it without making real customers solve puzzles. Below is a rebuilt example (not a real client), how to tell which kind you have, and what to do.
| What it is | How to spot it | What to do |
|---|---|---|
| Simple bots, and the form has no protection | Gibberish names, link-only messages, bursts at night, sometimes hundreds a day. The form settings show no honeypot or CAPTCHA | Switch on the plugin's own honeypot or anti-spam option first: Gravity Forms "Enable anti-spam honeypot" in Form Settings, WPForms "Enable anti-spam protection", Elementor Pro's Honeypot field. Then add Cloudflare Turnstile (free, no puzzle for most visitors, works whether or not your site uses Cloudflare) through the plugin's CAPTCHA or Integration page |
| Bots that get past a CAPTCHA | An old reCAPTCHA (v2 checkbox or v3) is on, but junk still arrives, often posted straight to the form's address without loading the page | Replace it with Turnstile or hCaptcha, keep the honeypot alongside it, and make sure the plugin checks the token on the server (it does when the integration is set up in the plugin, not pasted in as page code) |
| People pasting sales pitches | Readable English, a real-looking name and email, the same SEO or "funding" offer sent to thousands of sites. CAPTCHAs do not stop these, because a person solves them | Content filtering: Akismet checks each message against what it has seen across millions of sites (Contact Form 7 uses it through field options such as akismet:author_email; free for personal sites, a business site needs a paid plan). Contact Form 7 also blocks words listed in Settings > Discussion > Disallowed Comment Keys, so add the phrases that keep coming back. A "How did you hear about us?" or "What service?" dropdown that is required also cuts it, because pitch-pasters skip forms that need thought |
| Your form is being used to send spam to others | Bounces and "who are you?" replies from people you never wrote to; your site's emails start going to spam. The form has a copy-to-sender box or an auto-reply to the typed address | Turn off copy-to-sender and the auto-reply, or send it only after a CAPTCHA passes. Never put the visitor's address in the From field: send from your own address and put theirs in Reply-To. If your mail already lands in spam, see site emails not arriving |
| Junk sign-ups, comments or orders, not just the form | New user accounts with random names, comment spam, WooCommerce "card testing" orders of $1 | Turn off "Anyone can register" in Settings > General unless you need it, close comments on old posts, and add the same Turnstile check to the checkout (most payment plugins and anti-spam plugins offer it). Many fake orders at once is card testing: tell your payment provider |
Send yourself a real enquiry from your phone, on mobile data, through the live form: it should arrive, with your name and message intact. Then watch the inbox for two days. Most plugins keep blocked messages in a log or a spam folder (Flamingo for Contact Form 7, WPForms Entries, Gravity Forms' Spam list): look through it once, so a real customer caught by mistake gets a reply.
For most sites this is a honeypot switch, one free Turnstile key and a look at the auto-reply, about twenty minutes once you know which kind of spam it is. If you would rather hand it over, that is what the box below is for. Related: contact form messages never arrive, site emails not arriving, and hidden spam on your website.