In short and in plain language
Many contact forms get ads. Some are sent by programs. Others are typed in by people. Real requests can get lost in between.
Puzzles you have to click take time. Some people cannot solve them at all. Checks you do not see work better. One example is a hidden field. Mostly, only programs fill it in.
A hidden field does not stop ads from people. A clear line on the form helps. It says: please no ads here.
Do not delete unclear messages right away. Put them in a separate folder. Look at it every week. Move real requests back.
Send a test message every month. Then you see if the way is open. This is part of taking care of the website.
Monday morning in the inbox of a trade business: three new messages from the contact form. The first promises “more visibility on Google before the end of the month”, the second is a jumble of characters and a row of links, the third is a genuine enquiry about a new bathroom. It sits between the other two and gets overlooked, or it does not arrive at all because an overly strict filter sorted it out. Form spam rarely costs local businesses any data, but it regularly costs attention, and sometimes a job. Puzzle CAPTCHAs do little to help: they cost time, shut people out and are often a third-party service. This article shows how to catch spam in layers without testing your visitors, how to deal with advertising that people type in by hand, why borderline cases belong in a review folder rather than the trash, and how to measure false positives. At the end you will find what belongs in regular website maintenance.
Key takeaways
- Between September 2024 and April 2025, a single spam tool delivered messages through contact forms and chat windows to at least 80,000 websites (SentinelLabs); a language model wrote each text to match the site.
- A puzzle CAPTCHA takes 32 seconds on average (W3C 2021) and shuts out many people with disabilities. An invisible field, a minimum time, server-side checks, rate limiting and a content rule work without any third-party service.
- Sales and SEO pitches typed in by people get past every bot trap. A visible sentence on the form and a separate “offer to us” option keep them apart from real enquiries without blocking customers.
- Borderline cases belong in a review folder rather than the trash: review it weekly, release real enquiries and delete the rest after a fixed period, because data may only be kept as long as the purpose requires (Art. 5(1)(e) GDPR).
- The false positive rate shows whether rules are too strict: releases from the review folder divided by all real enquiries of the month. A monthly test enquiry during maintenance shows whether the path to the inbox is open.
- If a form token expires, that is a time limit under WCAG 2.2: without a way to turn it off, adjust or extend it, only a limit of more than 20 hours falls under the exception (WCAG 2.2).
What comes in through the form
Behind the term form spam are several very different senders, and each calls for a different response. The largest group are programs that search the web for forms and fill them in automatically. They send ads for dubious products, links to other sites or plain gibberish to test whether the form accepts anything. OWASP, an open community for web application security, lists this behavior in its catalog of automated threats as a separate entry, OAT-017 “Spamming” (OWASP): adding malicious or questionable content to messages and posts. Among its other names it explicitly lists form spam and SEO spam.
The second group are tools that no longer look like bulk mail. Security researchers at SentinelLabs examined a program that specifically targets contact forms and chat windows on the websites of small and medium-sized businesses (SentinelLabs) in order to sell a dubious SEO service. By their assessment from April 2025, it had targeted more than 400,000 websites since September 2024 (SentinelLabs) and successfully delivered messages to at least 80,000 websites (SentinelLabs). A language model wrote every message from the content of the respective website, so it reads as personal and differs each time. The researchers consider it likely that this is exactly what helps the messages bypass spam filters (SentinelLabs): a filter that looks for recurring phrases finds no pattern in such texts.
The third group are people. Agencies, link sellers and brokers type their offers into the form by hand, often with a reference to your industry, sometimes with a real name and phone number. They solve puzzles, wait out any minimum time and behave like ordinary visitors. No technique that tells people from machines helps against these messages; only a rule that sorts requests by purpose does. There is also a fourth, rarer case: forms that send a copy of the message to the address entered can be abused to distribute text to other people's inboxes. OWASP explicitly does not count this abuse as an automated threat but as a flaw in the implementation (OWASP). So it is not defended against but fixed: the copy is dropped, or it only contains a fixed acknowledgment without the text that was entered.
| Sender | Typical sign | What helps |
|---|---|---|
| Bulk bots | Fill in every field, submit within seconds, often with many links | Invisible field, minimum time, server-side checks |
| Targeted bots with a language model | Polite, fitting text, changing domains in the links | Rate limiting, content rule with a score, review folder |
| People with sales pitches | Real name, reference to your industry, an offer instead of a question | Notice on the form, separate “offer to us” option, sorting rule |
| Abuse of the copy function | Copies to other people's addresses, free text in the copy | Turn the copy off or reduce it to a fixed acknowledgment |
Why puzzle CAPTCHAs are the wrong lever
The reflex after the first wave of spam is often a CAPTCHA: distorted letters, traffic lights in photos, a checkbox saying “I am not a robot”. The World Wide Web Consortium examined these methods in the note “Inaccessibility of CAPTCHA”. The current version is a “Group Draft Note” dated December 16, 2021 (W3C), in other words the draft of an update to the note from 2019 (W3C). Its finding is clear: every interactive test requires a task that is meant to be easy for people and hard for machines, and precisely because of that it excludes many people with disabilities (W3C). Anyone with poor vision, anyone working with a screen reader or anyone who cannot decipher distorted characters faces a locked door.
Then there is the time involved. According to data from a large network services company quoted in the note, a person needs 32 seconds on average to solve a CAPTCHA (W3C 2021). For people with disabilities, the authors assume the effort is higher. At the same time, CAPTCHAs stop machines less well than expected: a University of Maryland study cited in the note reached a 90 percent success rate when solving the audio version of a widely used CAPTCHA service with the same provider's speech recognition (W3C 2021). And the spam tool mentioned above came with its own components to get around common CAPTCHA services (SentinelLabs). A puzzle mainly slows down the people you want to reach.
The third point concerns data protection. The widely used CAPTCHA services run on third-party servers, load additional scripts and in some cases analyze behavior in the browser. That usually requires a legal basis, a section in the privacy policy and often a data processing agreement; which agreements a website typically needs is explained in our article on data processing agreements. As an alternative, the W3C note describes methods that need no third-party service and give the visitor no task to solve: spam filters, computing tasks in the browser, heuristics and invisible trap fields (W3C).
Protection in layers, without a third-party service
What works against bots is not a single method but a sequence of small checks that the visitor does not notice. Each layer catches part of the spam, none has to be perfect, and if one fails, the others take over. Five layers are enough for most forms of local businesses; a sixth is an option for sites with a great deal of spam. The figures in this section are starting values, not standards; which limits fit only becomes clear by measuring your own inbox.
Invisible field
An additional input field pushed out of the visible area with CSS. People do not see it, yet many bots fill it in anyway. The W3C note considers it easy to implement even in hand-written markup and says it should be considered (W3C).
Minimum time
When delivering the page, the server places a signed timestamp in the form. If the submission arrives after just a few seconds, say under three, hardly any person has typed a name, an address and a request.
Server-side check
Anything the browser checks can be bypassed, because bots send directly to the server. That is why the server itself checks required fields, the email format, lengths and line breaks in the name or subject.
Rate limiting
More than a handful of submissions from the same source within a short time, for example five in ten minutes, are slowed down. The fitting response is status code 429 for too many requests (RFC 6585), plus a pointer to phone and email.
Content rule
A score instead of a ban: many links, short links, known sales phrases or a sender domain that matches no business raise it. Above a threshold, the message goes to the review folder, not the trash.
Option: computing task
With proof of work, the browser quietly solves a small computing task before submitting. For a single enquiry this hardly matters; for bulk submissions it costs computing power, and on older devices it can slow things down (W3C).
With the invisible field, the implementation decides how many false positives you get. The W3C note describes an example in which the trap field stayed visible and reachable by keyboard, labeled with a request to fill it in only if you are a robot (W3C). Anyone using a screen reader or a keyboard trips over exactly that. A better field is removed from the tab order, hidden from assistive technology and not filled in by the browser's autofill. A field name such as “email2” or “phone” can tempt browsers and password managers to fill it in, and then a real person is caught in the trap.
The minimum time also needs a sense of proportion. The timestamp belongs in the page delivered by the server and is checked on submission; if it only exists in JavaScript, a bot simply recalculates it. An upper limit, on the other hand, is tricky: someone who opens the form in the morning, continues writing at noon and then submits must not fail. If the page is also held in a cache, the timestamp is older than the visit. Which limits are acceptable from an accessibility point of view is covered further down in the section on data protection and accessibility.
For rate limiting, a look at the standard helps: RFC 6585 explicitly does not define how a server identifies users or counts requests (RFC 6585). That is both freedom and trap. If you count by IP address, you also hit company networks and mobile customers who share an address. The limit should therefore be generous and the response friendly: what happened and how the visitor can still reach you. Whether your server can keep such counters and a log at all also depends on your web hosting.
Advertising from people: what no bot trap detects
The most awkward group for any filter are messages written by people. “I took a look at your website and see great potential”, “We create high-quality backlinks for you”, “Would you be interested in a partnership?”: such texts are polite, cleanly worded and pass every bot trap. A spam filter that reliably catches them will sooner or later also catch real customers asking a short, factual question. A clear path for each kind of message works better than a stricter filter. Three building blocks help:
- A visible sentence on the form, for example: “Please do not use this form for advertising, SEO or partnership offers.” It does not stop everyone, but it makes clear that you do not want such messages.
- A selection field for the purpose with a separate option “offer to us”. Honest advertisers choose it, and the message automatically lands in a separate folder instead of the enquiry inbox.
- A content-based sorting rule that scores typical sales phrases, lists of links and senders without a recognizable business and moves messages above a threshold into the review folder instead of deleting them.
Legally, unsolicited advertising is not a trivial matter. Under the German Act against Unfair Competition, a commercial practice that unreasonably harasses a market participant is prohibited; this applies in particular to advertising even though it is recognizable that the recipient does not want it (Section 7(1) UWG). The sentence on the form can make that wish recognizable. Whether it is worth taking action against individual senders is a question for legal advice; in everyday terms, what matters is that advertising no longer clogs your enquiry inbox. Incidentally, some sales letters disguise themselves as an invoice or a verification request for your own domain; how to recognize such messages is explained in our article on fake domain invoices.
With automatically written sales texts, a different angle helps. SentinelLabs names the changing domains through which the advertised offer is sold as the easiest indicator to block, because the texts themselves no longer show a consistent pattern (SentinelLabs). For a content rule, this means that the link targets in a message say more than its wording. A link to a domain that belongs to no recognizable business weighs more than the word “ranking”. Anyone reworking the form anyway should keep it short: every field that is not needed costs real enquiries. Which fields are enough is shown in our article on how to turn visitors into enquiries.
A review folder instead of the trash
Every protective layer gets it wrong at some point. What matters is what then happens to the message. If it is silently deleted, nobody notices the mistake: the customer believes they have sent an enquiry, the business knows nothing about it, and each considers the other unreliable. The W3C note describes exactly the alternative for spam filters: many filters only delete messages automatically above a certain spam threshold and mark questionable messages for review by a person (W3C). For a contact form, this means three exits instead of two:
- Inbox: Everything that passes all layers and has no conspicuous score goes to the enquiry address as usual.
- Review folder: Messages with a raised score, with a striking number of links or from a throttled source land in a separate folder or in an overview in the admin area. Someone goes through it regularly, for example once a week, and releases real enquiries with one click.
- Discarded with a log entry: Only clear-cut cases, such as a filled-in trap field combined with a submission in under one second, are not delivered. They too remain in the log for a short period so that a false positive can be traced.
What the sender sees is important. A bot should not learn which layer caught it; a person should not be left in the dark. A good middle way: for the trap field and the minimum time, the form shows the usual confirmation, but the message goes to the review folder instead of disappearing. For rate limiting and rejected input, the form explains in words what went wrong and names phone and email as a second route. WCAG 2.2 requires this too: if a form detects an input error automatically, the field concerned is identified and the error is described in text (WCAG 2.2, success criterion 3.3.1).
The review folder is not an archive. Personal data may only be kept in a form that permits identification for as long as is necessary for the purpose (Art. 5(1)(e) GDPR). A fixed period after which entries are deleted automatically is therefore part of the setup from the start, for example 30 days. Released enquiries move into the normal inbox and follow your usual rules there; whatever remains in the review folder disappears when the period ends.
A spam filter is only properly set up once someone can check what it has sorted out.
Measure false positives instead of guessing
Whether your rules are too strict or too lax can be measured. The W3C note states the principle for all methods: testing and ongoing monitoring should decide on effectiveness, especially since a system that works today may prove ineffective a few years from now (W3C). For a contact form, a few figures are enough, and they can be read from the log and the inbox without any analytics tool.
| Metric | Where it comes from | What it reveals |
|---|---|---|
| Total submissions | Form log | The baseline; a jump signals a new wave |
| Caught per layer | Log, counted by reason | Which layer carries the load and which is redundant |
| Entries in the review folder | Review folder | How much manual work the rules create |
| Releases from the review folder | Review folder | False positives: real enquiries that were almost lost |
| Test enquiry arrived | Your own test enquiry | Whether the path to the inbox is open |
The most important figure is the false positive rate: releases from the review folder divided by all real enquiries of the month, that is, the released ones plus those that arrived directly in the inbox. If it rises, a rule is too strict. If advertising in the inbox rises instead, a rule is too lax. Neither is a reason to add another layer; it is a reason to move a threshold and then measure again. If you only receive a few messages a week, skip the rate and look at each release: which rule fired, and was it too strict?
A small script is worthwhile for the test enquiry: once from a smartphone over the mobile network, once from the office computer, once with a link in the message, just as a customer shares a photo from their cloud storage. If all test enquiries arrive, the rules at least let these typical cases through. If one is missing, you know which layer to check. Whether the notification itself reliably arrives is a separate question: how to set up the sender domain, SPF, DKIM and DMARC properly is covered in our article on professional email with your own domain.
Data protection and accessibility in spam protection
Even spam protection without a third-party service processes personal data: name, email address and message anyway, and for rate limiting also the IP address or a check value derived from it. The legal basis for spam defense is usually the operator's legitimate interest (Art. 6(1)(f) GDPR). If you rely on it, you state the legitimate interest pursued in the information on data processing (Art. 13(1)(d) GDPR), in this case defending the form against spam and abuse.
The advantage of the layers lies in data minimization. An invisible field, a timestamp and a counter per address for a few minutes stay on your own server. There is no data flow to a CAPTCHA provider, no scripts loaded from third-party servers and therefore no additional agreement for it. The rate-limiting counters are discarded when the time window ends, the review folder is emptied after its period, and the log contains only what is needed for troubleshooting.
Accessibility comes down to two points. First, the trap field must not appear for screen readers or keyboard users. Second, an expiry in the form is a time limit within the meaning of WCAG 2.2: if a form token expires after half an hour, the visitor must be able to turn off, adjust or extend the limit; exempt are limits of more than 20 hours (WCAG 2.2, success criterion 2.2.1). If you only check the minimum time and do without a short upper limit, you avoid the problem from the outset. For businesses that conclude contracts with consumers online, the German Accessibility Strengthening Act may also apply; which websites are affected is explained in our article on the BFSG for local businesses.
Not legal advice
Checking the form during maintenance
Spam protection is not something you set up once and then forget. Bots change their patterns, an update to the system or to a form component can silently switch off a layer, and a new email address in the business gets forgotten in the form. That is why the form belongs in regular upkeep, much like the updates and backups described in our article on website maintenance and security. A short list is enough:
- Send test enquiries through several routes once a month and confirm they arrived
- Review the review folder weekly and count releases as false positives
- Compare the number of catches per layer with the previous month
- Adapt content rules to new sales patterns and new link targets
- After every update, check that the trap field, timestamp and rate limiting still work
- Check that the review folder and the log are emptied after their period
If you offer a chat or an assistant alongside the form, include it in the same check. In newer versions, the spam tool examined also targeted the chat windows of many websites (SentinelLabs). How an assistant pre-qualifies enquiries and hands them over cleanly to the inbox is shown in our article on the AI assistant on your website. The effort for all of this stays manageable when it is planned; it only becomes expensive when a real enquiry sits unnoticed in spam for weeks.
How we set up the protection
For businesses in Hildesheim and the surrounding region, we set up contact forms so that they work without puzzles and without a third-party CAPTCHA service: with an invisible field, a minimum time, server-side checks, rate limiting and a content rule that moves borderline cases into a review folder. On our own websites, an invisible field, a minimum time and rate limiting protect the forms without a CAPTCHA. We also take over existing forms when the website was not built by us. How a form can bring in more enquiries beyond that is shown by our conversion optimization and the article More enquiries through your website; our services give an overview of everything else.
As part of website maintenance, we can include the form in the regular checks on request: test enquiries, a look at the catch figures, upkeep of the content rules and a check of the deletion periods. You learn what was sorted out and why, and you keep the decision on borderline cases. Use our contact form to tell us briefly how much spam arrives today and which enquiries matter to you.
Related Articles
Local delivery: an online shop with its own delivery area
Delivery area by postal code or radius, delivery windows, delivery fees by zone and correct notes on delivery restrictions: how local retailers deliver.
Website relaunch timeline: go live in your quiet season
Google advises moving a site during a slow period. How to find your quiet season, plan the relaunch backwards from go-live and set measuring points first.
Google Business Profile Posts for Advent Offers and Events
Update, offer or event: what Google requires for Business Profile posts, why a date range matters and what a post plan from November to January looks like.