Security guide
How to Stop Contact Form Spam Without Annoying Real Visitors
In short
Spam bots love contact forms. A hidden honeypot field, Cloudflare Turnstile, server-side checks and rate limiting stop most of it without making real customers solve puzzles.
The trick to stopping contact form spam is layering quiet, invisible defences so bots fail while genuine visitors sail through.
Add a honeypot field
A hidden field humans never see but bots fill in. If it's completed, you silently discard the submission. It's invisible, free and catches a surprising amount of junk.
Use a modern CAPTCHA alternative
Old image CAPTCHAs frustrate real people. A privacy-friendly challenge like Cloudflare Turnstile verifies visitors in the background with no puzzles, blocking bots without the friction.
Validate on the server
Never trust the browser alone. Check required fields, email format and message length server-side, and verify the CAPTCHA token before doing anything with the message.
Rate-limit and filter
Limit how often the same visitor can submit, and filter obvious spam patterns (links, known spam phrases). Together with a honeypot and Turnstile, this stops most automated spam.
Sites and forms that keep spam out
Gander Web builds fast, spam-resistant sites on secure UK hosting, contact forms included.
Talk to usQuestions
Do I still need a CAPTCHA if I have a honeypot?
A honeypot stops simple bots; pairing it with Turnstile catches the more sophisticated ones, with no friction for real visitors.
Will spam protection put off real customers?
Not if done well. Honeypots are invisible and Turnstile usually verifies silently, so genuine visitors notice nothing.
Why validate on the server if the browser already checks?
Bots bypass the browser entirely. Server-side validation is the only check you can trust.