The genuine cost of form spam is not the minutes spent deleting it. It is that a mailbox full of junk trains you to skim and bulk-delete, and sooner or later a real enquiry goes with it. The second cost is the defences people reach for, since aggressive filtering and heavy verification puzzles remove real enquiries as reliably as they remove bots.
The cost is not the time
Deleting a dozen junk submissions takes a minute. That is not the problem.
The problem is what it does to attention. A mailbox where most arrivals are worthless gets processed differently: skimmed rather than read, cleared in bulk, checked less often. Eventually a real enquiry with an unusual subject line goes in a bulk delete, or sits unread for two days because the mailbox stopped feeling urgent.
That is one lost job, which is worth vastly more than the accumulated minutes. And because it was deleted rather than never delivered, nobody ever finds out.
What is actually arriving
- Automated submissions from scripts that fill any form they find, usually to place links or test whether the address is live.
- Service pitches, offering search rankings, web design, or development, scraped from your contact page. These are sent by people and pass most automated defences.
- Address harvesting, where the objective is to get your reply so the address can be confirmed and sold.
- Fraud attempts, typically a request for a quote on a large job from an unusual location, leading toward an overpayment scheme.
The mix matters because they call for different responses. Automated submissions are a technical problem. Service pitches are a filtering problem and no technical measure on the form will stop them.
The defences that cost you real enquiries
Verification puzzles
They work against simple bots and they charge every genuine visitor for it. Image challenges are slow on phones, awkward for anyone with a visual impairment, and fail often enough that some people give up. On a form receiving a handful of enquiries a day, losing one real submission to friction costs more than the spam it prevented.
Blocking by country
Appealing and blunt. It blocks customers travelling, people using a VPN, and anyone arranging work in your area from elsewhere, which for a trades business includes property owners who do not live locally.
Aggressive keyword filtering
Rules built to catch marketing pitches catch real enquiries that happen to use the same words. A rule filtering "website" will bury the enquiry from a customer asking whether you saw their message on your website.
What works without charging the visitor
- A hidden field. A field invisible to people and visible to scripts. Anything that fills it is automated. Free, invisible, and it removes a large share of automated submissions on its own.
- A timing check. Scripts complete forms in under a second. Rejecting submissions faster than a person could plausibly type is effective and costs nothing.
- Validation on the server. Checking that fields contain what they should, that the message is not a wall of links, and that required fields are genuinely present.
- Rate limiting. One address submitting fifteen times in a minute is not a customer.
- An invisible verification service, which scores behaviour in the background and only challenges suspicious submissions. Where a puzzle is genuinely needed, this is the version that does not tax everyone.
Together these handle most automated traffic without any visitor knowing they exist. That is the standard worth holding: a defence the customer never encounters.
The filtering mistake
The most damaging response is applying a spam rule to the mailbox that receives enquiries, because those rules are invisible in operation. Mail is filed away and the inbox looks quiet, which reads as a slow week rather than a fault.
Enquiry notifications should arrive in a mailbox with minimal filtering, ideally one used for nothing else. Where a rule is genuinely needed, it should move mail to a folder that gets reviewed rather than deleting it, because the cost of reviewing a folder occasionally is trivial and the cost of a silently discarded enquiry is not.
Checking whether you are already losing them
- Submit your own form from a phone on mobile data and confirm arrival, then check the junk folder of the receiving address.
- Look in the junk folder for the past month, specifically for anything that reads like a customer.
- Compare form submissions recorded in analytics against emails actually received. A gap means delivery is failing somewhere between the two.
- Send a submission to a second address as a standing backup, so a filtering problem at one mailbox does not lose the enquiry entirely.
- Store submissions on the site as well as emailing them, which means a record exists regardless of what happens to the mail.
That last measure is the one worth having whatever else you do. Email is the least reliable part of the chain, and a form that records what it received leaves you with the enquiry even when the notification never arrives.
Frequently asked questions
How do I stop website form spam?
A hidden field that only scripts fill, a timing check that rejects instant submissions, server-side validation, and rate limiting handle most automated traffic. All of them are invisible to real visitors.
Should I use a CAPTCHA on my contact form?
Visible puzzles charge every genuine visitor to stop bots, and on a form receiving a few enquiries a day losing one real submission costs more than the spam prevented. An invisible scoring service is the better option where verification is needed.
Why did a real enquiry end up in my junk folder?
Usually an aggressive filter rule on the receiving mailbox. Enquiry notifications should go to a mailbox with minimal filtering, and any rule should move mail to a reviewed folder rather than delete it.
What is a honeypot field?
A form field hidden from people but visible to automated scripts. Anything that fills it is a bot, so the submission is rejected. It costs nothing and catches a large share of automated spam.
How do I know if I am losing real enquiries?
Compare form submissions recorded in analytics against emails actually received, and look through the junk folder for anything that reads like a customer. A gap between the two numbers means delivery is failing.
Should form submissions be stored as well as emailed?
Yes. Email is the least reliable link in the chain, and storing submissions means the enquiry still exists even when the notification is filtered, bounced, or deleted.
West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.
Confident every enquiry is reaching you?
We build forms that block automated spam invisibly, store every submission on the site, and send to a backup address so nothing is lost to a filter.
Start a Conversation