Form spam defined.
Form spam is junk pushed through website forms by bots and paid submitters, fake submissions carrying links, scams or pitches, sent because a form is the cheapest route into a human-read inbox.
Why bots send form spam
A contact form is a published promise that a human reads what comes through it, which makes it a target. Crawlers sweep the web for <form> tags the same way search engines sweep it for links, then POST scripted payloads to every one they find: link-drop spam chasing SEO value, phishing lures, fake quote requests probing for a reply. None of it is personal; your form was simply on the list, and submitting to it costs the sender nothing.
The traffic splits into two kinds, and each falls to a different defense. Automated bulk spam comes from scripts that fill every field they can see. A hidden honeypot field catches these almost perfectly, because the bot fills the trap too. Targeted spam, from smarter bots or human submitters paid to pass the checks, needs heavier tools: a captcha challenge and rate limits on abusive senders. FormWire runs the honeypot on every form by default and lets you add hCaptcha, reCAPTCHA or Cloudflare Turnstile per form when one is being singled out, with everything that was flagged reviewable in a spam tab, so a real lead never disappears unseen.
The three faces of form spam.
Bulk bots
Scripts that find forms at scale and fill every field. The vast majority of spam volume, and the easiest to trap with a honeypot.
Targeted bots
Tuned to a specific site, skipping obvious traps. Captcha challenges and rate limits raise the cost until it stops being worth it.
Human spam
Paid submitters pass every automated test. Filtering can flag patterns; the spam tab keeps the judgment call yours.
Related questions
A crawler found it and added it to a list, and lists get shared and resold, so volume compounds rather than fading. The fix isn't hiding the form; it's filtering at the endpoint so the junk stops before your inbox.
See the filters FormWire puts in front of your inbox →The real price isn't annoyance, it's buried leads. When nine of ten submissions are junk, the tenth (a genuine customer) gets skimmed past or deleted with the batch. Filtering exists to protect your response time to real people.
Start lighter. A honeypot filters the bulk traffic invisibly, at zero cost to real visitors. Add a captcha per form when one is being specifically targeted. Friction is a tool to escalate to, and every flagged submission stays reviewable either way.
How rate limiting slows abusive senders →It trades one problem for a worse one: a published email address gets harvested for spam directly, and you lose validation, filtering and the record of what was sent. A filtered form endpoint keeps the address private and the junk out of sight.
How a form backend filters submissions →Want to see it working?
Read the docsKeep your inbox for real people.
Free tier forever. No credit card required.