What do you do when your contact form fills up with spam?

The short answer: contact form spam is almost never a person. It is software, called a bot, that roams the web looking for forms and fills in every one it finds. It does not mean your website was hacked or that you set something up wrong. It means your website is now visible, and the fix is usually one setting: turn on the spam protection built into your form, delete what still gets through, and never click the links.

Quick answer

• Contact form spam comes from bots, automated programs that find forms and submit the same messages to thousands of websites at once.
• It is normal, not a sign of trouble. Imperva's 2025 Bad Bot Report found that automated bots made up 51% of all web traffic in 2024, more than humans.
• Spam does not mean you were hacked. The form did its job: it sent you what was typed into it.
• Two tools stop most of it: a checkbox test that asks the sender to prove they are a person, and a hidden trap field that only bots fill in.
• Never reply to spam, never click its links, and never open its attachments. Delete and move on.
• Do not remove the form. Real customers use it, and a form protects you better than showing your email address to the whole web.

Why is your contact form getting spam?

Bots roam the web around the clock. They follow links from page to page, and when one lands on a page with a form, it fills in the boxes and presses send. Your contact form does exactly what it was built to do: it takes what was submitted and emails it to you. The bot does not know or care what your business is. It found a form, so it fired.

This is not a small corner of the internet. Imperva's 2025 Bad Bot Report found that automated bots made up 51% of all web traffic in 2024. More than half of everything moving around the web is software visiting pages, not people. Your contact form is standing in that traffic.

There is even a backwards kind of comfort in it. A brand new website often gets found by bots before it gets found by people, because bots check search engines, link lists, and fresh domain registrations all day. So spam in week one does not mean something is wrong. If you are also wondering where the human visitors are, our guide on why nobody is visiting your new website yet covers that side.

Does spam mean your website was hacked?

No. This is the fear behind the question, so it is worth saying plainly. A spam submission is someone using your form the way a visitor would, just with junk. Nothing got into your website. Nothing was taken. Being hacked looks different: your pages change without you changing them, your login stops working, or visitors see warnings when they open your website.

Spam only becomes dangerous if you act on it. So three rules, and they cover almost everything:

1. Never click the links. The whole point of most spam is to get one click. The link can lead to a fake login page, a download, or a scam pitch.
2. Never reply. A reply proves a real person reads this inbox, and that puts you on more lists, not fewer.
3. Never open attachments. A real first enquiry from a stranger almost never comes with a file attached.

Delete the message and it has cost you five seconds. That is the entire worst case, as long as you do not click.

How do you stop most contact form spam?

You do not fight the bots yourself. You turn on protection that is built into most website builders and form tools, usually as a switch in the form's settings. Open your website editor, click on your form, and look for a setting with spam, CAPTCHA, or bot protection in the name. Two kinds do most of the work, and it helps to know what each one actually does.

The checkbox test. Often called a CAPTCHA. It adds a small step that asks the sender to prove they are a person, usually a single checkbox that says I am not a robot. Behind the scenes it checks how the box was ticked, because people and software press buttons differently. Simple bots fail it, and the flood usually drops on the day you turn it on.

The hidden trap field. Often called a honeypot. The form gets an extra box that people never see, because it is invisible on the page. A person leaves it empty. A bot reads the form's code, sees another box, and fills it in, and that is what gives it away. The form then throws the submission out quietly. No extra step for your real customers at all.

If your form's settings offer either one, turn it on. Neither is technical to use, whatever the names sound like. And if some spam still trickles through, that is normal. The goal is to get from twenty junk messages a day to one a week, not to reach zero.

Should you swap the form for your email address?

It feels logical: the form attracts spam, so remove the form and just write your email address on the page. In practice this trades a solvable problem for a worse one. Bots also harvest email addresses straight off web pages, and once your address is on a spam list, there is no setting that takes it back off. A form with a trap field filters junk before it reaches you. A published email address has no filter at all.

The form also works better for you. It can ask for what you need up front, like a phone number or what the enquiry is about, so real messages arrive ready to answer. Our guide on what should be on your contact page shows how the whole page fits together, form included.

How do you keep real messages from getting lost?

The quiet cost of spam is not the junk itself. It is the real enquiry you scrolled past while deleting junk, or the week you stopped checking the inbox because it was all noise. A new customer who hears nothing back does not try again. They move on to the next business.

Three habits protect you:

1. Check at a set time every day. Once a day is enough at the start. Spam gets deleted, real messages get answered, and nothing sits for a week.
2. Answer real enquiries fast. Same day if you can. For a new business, speed is the trust signal you can offer before you have reviews.
3. Look in your email's own spam folder weekly. Filters sometimes guess wrong in both directions, and a real customer's message can land there.

A message from a real person is the most valuable thing your website produces, so treat the inbox as part of the job, not an accessory. Our guide on turning website visitors into quote requests or calls covers what to do with the real ones once they arrive.

What if the spam keeps coming anyway?

Some will. Spam protection is a filter, not a wall, and a little junk getting through means nothing is broken. Keep deleting it without reading past the first line, and it stays a ten-second chore, like junk mail in a paper mailbox.

If the volume climbs back up, escalate one step at a time. Turn on the checkbox test if you only had the trap field. Check whether your form tool has a strictness setting and raise it one notch. Then watch for a week before changing anything else, and keep an eye on the thing that actually matters: real messages still arriving. That, not an empty spam folder, is the sign of a healthy contact form.

Spam is a side effect of being visible, and being visible is the whole point. Set the protection once, keep the daily check, and the form goes back to doing its real job: catching the people who want to pay you. And if your website is not online yet and this is all still ahead of you, start with your description and get a website built around your business.