Contact Form Spam Getting Past the Checkbox

The checkbox that stopped working

The contact form has a checkbox that says I am not a robot. The spam arrives anyway: offers of first-page rankings, links to sites nobody would visit, and messages that are just a string of nonsense.

At first it is one or two a week. Then it is several a day, and somebody at the business starts skimming the form notifications rather than reading them.

That is the real cost. Somewhere in the pile is a genuine enquiry, skimmed past, deleted with the rest, or filed into the spam folder by an email system that has learned to distrust the form.

How the bots get past

Some checkboxes were never a test at all. A plain box added by a form plugin, with no checking behind it, is ticked by a script as easily as by a person.

Google's reCAPTCHA checkbox is a real test, looking at how the visitor behaves before deciding whether to show a picture puzzle. It stops a great deal, but not everything.

Automated tools have become better at passing for a person, and some services simply pay people to solve the puzzles.

A small business form is rarely targeted on purpose. It is caught by tools that try every form they find.

What the spam is after

• Links, in the hope of being clicked or published somewhere.
• Your autoresponder, which can carry their message to someone else.
• Your attention, with offers of search rankings and web work.
• Weak spots, such as upload fields that accept any kind of file.
• Nothing in particular, since the scripts fill in every form they meet.

The second turns spam into your problem. A form that sends a thank-you, or a copy of the message, to whatever address was typed will send a spammer's text to strangers, from your server, under your name.

Why it becomes an email problem

Messages your server sends to people who never asked for them bounce or get reported, and email providers lower their opinion of your server and your domain.

That same reputation decides whether your ordinary emails, the quotes and invoices, reach the inbox.

Many forms also put the visitor's own address in the From line of each notification. Large email providers increasingly refuse mail that claims to be from their users but comes from somewhere else, so genuine notifications go missing too.

And every time somebody marks a form notification as spam, the mailbox learns that messages from the form are unwanted, including the real ones.

The invisible reCAPTCHA

Last autumn Google released a newer version of reCAPTCHA that shows no checkbox and no puzzle at all.

Instead it watches how visitors use the site and gives each submission a score, from very likely a person to very likely a bot.

The site decides what to do with low scores: refuse them, hold them for review, or ask for an extra step.

That decision is the part that needs setting up properly. The score only helps if the server checks it before sending anything, and a cut-off that is too strict turns away real customers.

Like the checkbox version, it sends information about visitors to Google, which is worth a line in your privacy policy.

A honeypot field

A honeypot is a form field that people never see. It is hidden from view, so a person leaves it empty, while a script that fills in every field it finds puts something in it.

Any submission with that field filled in is discarded without bothering anyone.

Done properly, the field is also hidden from screen readers and skipped by the keyboard, so nobody using assistive technology lands in it, and it has a name that browsers will not fill in automatically.

A simple timing check works alongside it. A person takes more than a couple of seconds to complete a form; a script often submits it instantly.

A worked example

A wedding and events venue on a rural property took most of its bookings through a contact form, protected by a plain checkbox the theme had supplied.

By last autumn the form was producing several spam messages a day. Staff were skimming the notifications, and two genuine enquiries about summer dates were found weeks late in the spam folder.

The form had also been sending every visitor an automatic copy of their message, which meant it was sending spam text to strangers' addresses from the venue's own domain.

The fix replaced the checkbox with invisible scoring and a honeypot, held low-scoring messages for weekly review instead of deleting them, and changed the automatic reply so it no longer repeated what was typed.

Notifications now come from the venue's own address, with the visitor's address set as the one to reply to.

Filtering on the server

Whatever reaches the server can be checked before anyone is emailed.

Simple rules catch a lot: messages with several links, messages that repeat known spam phrases, or many submissions from the same source within a few minutes.

Filtering services compare each message against spam reported across many other sites, which catches patterns no single small business would notice.

Suspicious messages are better held in a folder than deleted outright. A weekly look takes two minutes and rescues the occasional real enquiry that tripped a rule.

Fixing the notification email

The email the form sends deserves the same attention as the form itself.

Send notifications from an address at your own domain, and put the visitor's address in the reply-to field, so replying still works and nothing pretends to come from someone else's provider.

Turn off any option that sends visitors a copy of what they typed. If you want an automatic acknowledgement, keep it short and fixed, so it carries nothing a spammer wrote.

The counter-case

Not every form needs all of this.

A site that gets a stray spam message once a month can live with its checkbox, provided the notification email is fixed, since that is the part that protects your own email.

Stricter is not always better, either. Picture puzzles are hard for some people with visual or motor impairments, and an over-eager filter loses enquiries quietly, which is worse than spam you can see.

Use the lightest protection that keeps the inbox readable, and always fix how the form sends its email.

This week

1. Count the spam arriving through your forms.
2. Check the spam folder for real enquiries.
3. Switch off copies sent to visitors.
4. Send notifications from your own domain.
5. Add a honeypot and a timing check.
6. Consider invisible scoring if spam continues.
7. Hold suspicious messages for review, not deletion.

Step three is the one that protects everything else. Spam you receive is a nuisance; spam your server sends to strangers damages the reputation every quote and invoice depends on.

Spam also piles up in the stored entries, which is covered in where your website keeps old form submissions.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.