Why your contact form fills up with junk (and how to stop it)

What does form junk actually look like?

This month, a “lead” came through one of the local forms we look after. It had a name, a phone number, a ZIP code and a polite message. But the phone number had nine digits. The ZIP code was “4884 Ma”. The message was a pitch to sell business contact lists, sent from the list vendor’s own email address. And it was never typed into the page at all. A script sent the form data straight to the server.

That’s typical. Most form junk falls into three groups:

• Sales pitches from list vendors, SEO agencies and “partnership” offers.
• Fake details such as short phone numbers, ZIP codes with letters, and throwaway email addresses.
• Bots that post to the form without loading the page, often with links in the message.

Why does junk get through a basic form?

A basic form checks almost nothing. As long as the required boxes aren’t empty, it accepts the entry and emails it to you. It doesn’t know that a phone number needs 10 digits, or that a Michigan ZIP code is five numbers.

Many forms rely on one trick, such as a single hidden field or a word blocklist. Spammers learn those tricks quickly. The pitch we saw above passed a hidden field, used no blocked words and had only one link, so each single check waved it through. What catches it is several small checks added together. No one sign proves an entry is junk, but four or five signs together usually mean it is.

1. Check the details people type

Start with the fields themselves. The OWASP input validation guide recommends checking data in the browser and again on the server.

If you only serve West Michigan, a ZIP code far outside the area is worth a flag, not a block. Grand Rapids ZIP codes start with 495, and you can check any code with the USPS lookup. When a field is wrong, show a clear message next to it. A real person with a typo will fix it and send again.

2. Add a honeypot and a time check

A honeypot is a form field that people never see, because it’s hidden from view and from screen readers. Bots fill in every field they find, so an entry with the honeypot filled in is almost certainly a bot.

A time check is just as simple. A person takes at least 10 seconds to fill in a contact form, and usually a minute or more. An entry sent two seconds after the page loaded wasn’t typed by a person.

Some bots skip your page entirely and send the form data straight to the server. A small piece of code on the page can mark entries sent from a real browser, so an entry without that mark counts as a warning sign. Keep the form working for people who have scripts turned off, though. That’s why the next step scores entries instead of blocking them.

3. Score junk and flag it, don’t delete it

Here is the step most forms skip. Instead of one pass-or-fail rule, give each warning sign a few points:

• The phone number or ZIP code is invalid.
• The honeypot is filled in, or the form was sent in seconds.
• The entry didn’t come from a browser.
• The message has links, or uses sales-pitch phrases.
• The email comes from a known list vendor or a throwaway service.

Above a set score, the entry goes to a flagged folder instead of your inbox. It is kept, not deleted. Filters make mistakes, and a real customer who typed one wrong digit shouldn’t vanish. Skim the flagged folder once a week, and move any real entry back with one click. The junk from our example scored far above the line. A genuine test entry with an obviously fake phone number scored low and still came through.

4. Use an invisible check, not a puzzle

Picture puzzles (“click every traffic light”) stop some bots, but they also stop people. Visitors give up halfway, and the W3C’s note on CAPTCHA explains how visual puzzles shut out many people with disabilities. For a small business, a lost customer costs more than a spam email.

An invisible check is a better trade. Cloudflare Turnstile runs in the background while the visitor fills in the form. It’s free, and most visitors never see anything. When it’s unsure, it shows a simple checkbox, not a puzzle. Your site then checks the result on the server before it accepts the entry. Treat it as one more layer in your score, not as the only guard.

5. Make sure real messages reach your inbox

The worst form problem isn’t junk. It’s a real enquiry that never arrives. Many forms send their notification “from” the visitor’s email address. Gmail and Outlook see a message claiming to be from someone else’s address, and they may put it in spam or reject it. Google’s sender guidelines spell out what mail providers expect.

Three habits fix most of this:

• Send notifications from an address on your own domain, with the visitor’s address as the reply-to.
• Set up your domain’s email records (SPF, DKIM and DMARC) so providers can trust that mail.
• Keep a copy of every entry on the website, so a missing email never means a missing lead.

Then test it. Send yourself an entry from your phone every month and check it lands in your inbox.

Want us to set this up for you?

Most small business owners don’t want to tune a spam filter. If you’d rather hand it off, we’ll set up your existing form with field checks, a honeypot and time check, scoring that flags instead of deletes, an invisible check and a delivery test. It works with most WordPress form plugins, and we’ll explain what each piece does.

We use the same layered approach in software we run ourselves. Our fantasy football data service confirms each email address before it issues an access key. You can read how we built it in the GridIron Data case study on 45squared.com.

Tell us about your site in the form below. Aaron or someone from the team will reply, usually within one business day.

How to cut contact form junk in an afternoon

1. Check the details

   Require a 10-digit US phone number, a 5-digit ZIP code and a real email format. Show a clear message next to any field that’s wrong, so a real person can fix a typo.

2. Add a honeypot and a time check

   Add a hidden field that people never see but bots fill in, and note how fast the form was sent. A form finished in two seconds, or sent without the page ever loading, is suspect.

3. Score entries instead of deleting them

   Give each warning sign a few points. Above a set score, send the entry to a flagged folder instead of your main inbox. Never delete it automatically.

4. Add an invisible check

   Use an invisible check such as Cloudflare Turnstile instead of a picture puzzle. Most visitors never see it.

5. Test delivery

   Send a test entry from your own phone every month. Confirm it arrives in the inbox, not spam, and that the site keeps a copy of every entry.