Contact form spam
Stop contact form spam without a CAPTCHA.
Most contact form spam comes from simple scripts, not people. This guide shows the checks we use on our own WordPress form, what each one stops, and why some enquiries are marked for review instead of being thrown away.
What arrives
Look at the spam before choosing a fix.
Between 3 and 22 October 2026, the English version of the contact form on this website delivered 11 messages. We opened the six most recent. Five came from the same automated sender, each a single sentence asking for the price in a different language. One was a sales pitch. None was a real enquiry.
The pattern matters. The sender loaded the page before posting, so it passed the hidden field and the security token, and it sent too rarely to reach a rate limit.
Spam sent directly to the mailbox address is a different problem. The mail provider filters it, and nothing on the website changes that.
Layers
What each check stops.
01
Hidden field
A field people never see. Many scripts fill in every field, so a value there means a bot. It costs nothing, but scripts that read the page leave it empty.
02
Security token
A short-lived WordPress nonce in the form. A request sent without loading the page fails. It does not stop a script that loads the page first.
03
Rate limits
Limits per IP address and per email address within a short window. They stop floods, not a sender that posts once every few days. Behind a CDN, count the visitor’s real IP address, not the address of the CDN node.
04
Signed time
The form carries the time it was shown, signed with a secret. A message sent within a few seconds, or with a forged or day-old time, is rejected without sending any email.
05
Browser proof
A value the page script adds only after someone focuses, types or clicks in the form. It is not in any form field, so scripts that only read the HTML never send it.
Mark, do not drop
Why some enquiries are flagged, not rejected.
Some real visitors browse without JavaScript, and some privacy tools block scripts. Rejecting every message without the browser proof would lose them.
Our form still delivers those messages. It adds “[provjeri]” (Croatian for “check”) to the start of the subject and a line to the body. A mail filter moves them to a separate folder, where they take seconds to review.
Only messages no person can send are rejected outright: a form submitted faster than it can be read, or a time stamp that was forged or has expired. The visitor then sees a clear message and can send again.
Want help applying this to your website? See Website security or tell us about your project ↗
Why not a CAPTCHA
The trade-offs of a third-party check.
- A CAPTCHA service loads an external script. That usually means another data processor in your privacy policy, and often cookies or device signals.
- Puzzles and challenges add effort for every visitor, and some are hard to complete with assistive technology.
- A CAPTCHA does stop more automated traffic than the checks above. If flagged spam keeps growing, a privacy-friendly challenge can be the next step, with the privacy policy updated first.
Test it
Check the real path, not just the code.
- Send one enquiry from a normal browser and confirm that it arrives without the mark.
- Send one without JavaScript, for example as a plain form request a few seconds after loading the page, and confirm that it arrives with the mark.
- Submit immediately after loading the page and confirm that it is rejected with a clear message and no email.
- Confirm that the form still sets no cookies.
We ran these four checks on 23 October 2026. It is too early to say how much spam the new checks catch, so this guide makes no claim about results.
Checklist
Before you change your form.
- Have you read the last ten spam messages and noted how they were sent?
- Does the form have a hidden field and a security token?
- Do rate limits count the visitor’s real IP address behind your CDN?
- Is there a minimum time between showing the form and sending it?
- Are messages without the browser proof marked rather than rejected?
- Does a mail filter move marked messages to their own folder?
- Have you tested a normal, a script-free and an instant submission?
- If you add a third-party challenge, is your privacy policy updated first?
Delivery is part of the same question. See WordPress maintenance checklist for the checks that belong in regular care.
Want a form that reaches you?
Our WordPress care includes checking that enquiries are delivered, not only that the form loads.