The most reliable way to stop contact form spam is to layer several quiet defences: validate everything on the server, add a hidden honeypot field, limit how often one source can submit, and use a low-friction bot check only if spam still gets through. Visible puzzles should be the last resort, because every extra step costs genuine enquiries and can exclude people.
Start with the server, not the browser
Browser checks improve usability but are not security. The OWASP Input Validation Cheat Sheet states that client-side validation is bypassable, so the server must enforce the rules, and it recommends allowlists: define what you accept and reject everything else, rather than trying to recognise every malicious string. See the OWASP cheat sheet.
For a contact form that means:
- Required fields checked on the server, with a clear error returned, as in the interactive websites approach of progressive enhancement.
- Length limits on every field, including the message.
- An allowed set of values for dropdowns and checkboxes.
- Rejecting requests that carry fields the form does not have.
Allowlisting is not a replacement for safe database queries and output encoding. It is one layer.
Add cheap invisible defences
Honeypot field
A honeypot is an extra field hidden from people but visible to simple bots that fill every input. If it arrives with content, discard the submission quietly. Hide it with CSS rather than the hidden input type, give it a plausible name, and exclude it from keyboard focus so assistive technology users do not meet it. Honeypots stop unsophisticated bots only, which is still a large share of the noise on a typical small site.
Time and rate limits
Bots often submit instantly. A form that records when it was rendered can treat a submission arriving within a second or two as suspect. Separately, limit the number of submissions per source over a short window. Choose limits generously, since shared office networks send many legitimate requests from one address.
Content rules
Reject messages containing many links, or fields that should hold a name but contain a web address. Review rejected messages for a while before making rules stricter, so you learn what false positives look like.
When to add a bot check
If spam persists, add a challenge that works mostly in the background. Cloudflare’s documentation describes Turnstile as working without showing a visual or interactive puzzle, with a managed mode that shows a checkbox only when risk warrants it, plus non-interactive and invisible modes. Read the Turnstile overview.
Importantly, the widget alone does nothing. The server-side validation guide says you must call the Siteverify API, that the client-side widget alone does not protect your forms, and that tokens are valid for 300 seconds. A form that displays the widget but never verifies the token is decoration.
Mind accessibility
Image puzzles and word-recall tests can lock people out. WCAG 2.2 success criterion 3.3.8 addresses cognitive function tests in authentication steps, and notes that a CAPTCHA requiring someone to remember or type a word, or recognise a picture the site supplied, does not qualify for the exception, while general object recognition does at level AA. See the W3C explanation. That criterion is about login steps, not contact forms, but it shows the direction of travel: avoid making people prove their humanity with a puzzle.
Comparison
| Method | Friction for people | Stops | Weakness |
|---|---|---|---|
| Server validation | None | Malformed, scripted requests | Does not stop valid-looking spam |
| Honeypot | None | Simple bots | Targeted bots skip it |
| Rate limiting | Rare | Floods | Shared networks need tuning |
| Managed or invisible check | Low | Many automated tools | Needs server verification |
| Visual puzzle | High | Some bots | Accessibility and drop-off |
Measure the trade-off
Count genuine enquiries as well as blocked spam. If a new rule cuts spam but real submissions fall, it is too strict. Route suspected spam to a review folder for a few weeks rather than deleting it. The broader form design principles are in what makes a business website convert, and forms on campaign pages are covered in landing pages that convert campaign traffic.
Where Radiance Impact fits
Radiance Impact’s Technology division builds business websites, landing pages and workflow automation, including forms that route enquiries into your existing process. Explore /technology or contact us.
Sources
- Input Validation Cheat Sheet, OWASP
- Understanding SC 3.3.8: Accessible Authentication (Minimum), W3C
- Cloudflare Turnstile overview, Cloudflare
- Turnstile server-side validation, Cloudflare
