Information checked: 21 July 2026.
Contact-form spam ranges from harmless bulk messages to phishing, abuse of email delivery and automated attempts to exploit form handling. The aim is to reduce abuse without creating an inaccessible obstacle for genuine customers.
In brief: Combine safe server handling, quiet bot controls and staff awareness rather than relying on one visible challenge.
Start with the form design
- Collect only fields required to handle the enquiry.
- Validate data on the server, not only in the browser.
- Limit message size, attachment types and upload destinations.
- Do not echo untrusted input into confirmation pages or email headers.
- Use a clear success state without revealing internal details.
Layer proportionate controls
| Control | Benefit | Caution |
|---|---|---|
| Honeypot field | Stops simple bots with little user friction | Advanced bots may bypass it |
| Rate limiting | Restricts repeated automated submissions | Allow for shared networks and legitimate bursts |
| Time-based checks | Flags forms submitted impossibly quickly | Do not block assistive or password-manager use |
| Reputation or challenge service | Blocks broader automated abuse | Review privacy, accessibility and failure behaviour |
| Email authentication | Protects the domain and improves delivery | Does not validate form content itself |
Protect the receiving process
- Send through an authenticated service.
- Use fixed application addresses rather than user input in mail headers.
- Log a submission identifier and delivery result.
- Quarantine suspicious attachments outside the public web root.
- Train staff not to trust links or documents merely because they arrived through the website.
Acceptance check
Test normal submission, keyboard and screen-reader use, rate limiting, delivery failure and spam handling. Keep a manual contact alternative when the protection service fails.
Test the fallback as well as the filter
A challenge provider or reputation service can become unavailable or block legitimate visitors. The business needs a fallback contact route and a way to identify messages that were rejected or delayed. Review whether spam controls create disproportionate friction for disabled users or people on shared networks.
Records to keep
- Form and delivery test results.
- Rate-limit and rejection logs.
- Fallback contact route.
- Privacy and supplier assessment.
Owner test: Submit the form from mobile, keyboard-only use and a different network, then deliberately trigger the anti-spam rule and inspect the user message.
Sources and date checked
This practical guidance was checked against the following primary sources. Date checked: 21 July 2026.
Keep the decision under your control
Retain the relevant accounts, source material, supplier terms and recovery information. Recheck changing prices, interfaces and rules before acting.