Contact form spam is a big problem for website owners. It seems like it doesn’t matter if your WordPress website is big or small, spambots will inevitably target your website and send useless emails to your inbox (in reality, the big guys get it much worse).
But whether you’re a large publisher or small business, the good news is that there are some automated methods you can use to stop contact form spam in WordPress websites.
What is contact form spam?
Technically speaking, form spam is when bad actors or malicious organizations submit unsolicited data through online forms to distribute unwanted messages or malicious content.
In simpler terms, form spam occurs when unwanted messages find their way through your website’s forms (and sometimes appear on the front end of your website) – often without you realizing it.
You might think that contact form spam shouldn’t be a problem these days. After all, traditional and legacy email spam is mostly under control thanks to advanced spam filters specifically designed to block spam messages.
But website forms aren’t quite there yet, and form spam continues to plague us in the form of junk messages and irrelevant links.
What’s more, spam via contact forms continues to occur because it actually works. For example, spammers look for loopholes and vulnerabilities in your website forms to hijack them and then use them to forward email spam messages to others.
These spam emails end up in users’ inboxes and look like the emails you might send. Then, people unknowingly open the spam email and even click on it to go to a website they think is yours, only to be taken to a completely different website.
The email spammer now benefits from the increase in traffic to your WordPress website and increased engagement on the website.
Also, most spammers try to take advantage of the web forms on your website where they can post their target messages with hyperlinks to other websites and properties to gain link equity and improve search engine optimization (SEO).
What are spambots?
Spambots are basically a malicious computer program specifically designed to collect email addresses and vital information from online sources such as contact forms, websites and chat rooms. Generally, this data is collected to send unsolicited emails.
Since spam emails have a special structure, it is easy to create this type of bot. Unfortunately, it is difficult to ignore them.
Sometimes people use the technique of decoding addresses to confuse bots by displaying emails in different styles. But even this method has some drawbacks. That’s why we have some good ideas to stop bots from spamming your contact forms.
How to protect contact forms from spam
As we’ve established, spam submissions through contact forms can waste your time, clutter your inbox, and potentially expose your website to security risks. Here are four of the most commonly used methods to stop spam in contact forms.
Use reCAPTCHA
reCAPTCHA is a security feature that verifies human users before they can submit your contact form – you’ve likely seen the eCAPTCHA part of a form before when trying to submit something before being asked to verify you’re human.
This helps block spam submissions by making sure that it’s not a bot, as they’re incapable of filling out your contact forms (for now, at least) and also blocks most spam attempts.
reCAPTCHA is useful not just for yourself, but visitors to your site generally feel safer and better when they see verification measures. This is because it shows that security is important for your website and potentially company too.
reCAPTCHA has evolved over the years, with several different versions release:
- reCAPTCHA v2: This basic versions offers a simple checkbox that most of us will have come across, the “I’m not a robot” message or image-based verification.
- Invisible reCAPTCHA v2: A more stealthy approach that runs verification in the background, only challenging suspicious users.
- reCAPTCHA v3: Uses advanced behavior tracking to assign risk scores without user interaction.
While reCAPTCHA v3 is the most advanced, it can sometimes block legitimate users with unusual browsing patterns. For most websites, reCAPTCHA v2 offers the best balance between security and user experience
Use a custom CAPTCHA
Custom CAPTCHAs add a layer of protection by requiring users to solve word-based or mathematical questions before form submission. Users must answer all of your custom questions correctly in order to submit their contact form.
With WPForms, a WordPress contact form plugin, you can even add multiple custom word-based questions that run randomly through the contact form each time a page or post is loaded.
If using WordPress form builders like WPForms, you can set up randomized questions that change with each page load, making automated attacks even more difficult.
Use the Honeypot technique
If you’re not a big fan of CAPTCHAs or reCAPTCHAs, you can also use the honeypot method instead, as this is an invisible anti-spam solution that works without disrupting the user experience.
Honeypots are small pieces of code that are designed to catch spambots by displaying a hidden contact form field only to spam bots, and you don’t need to worry about your visitors interacting with them as they are invisible to human users
These pieces of code work with three steps:
- Hidden Fields: The code creates form fields that are invisible to human users.
- Bot Detection: The automated spam bots then typically fill out all available fields.
- Automatic Filtering: When the hidden field contains data, the submission is flagged as spam.
The beauty of this approach is that legitimate users never see or interact with the honeypot field, so it doesn’t affect their form experience at all.
Use WordPress antispam plugins
You can also use anti-spam plugins for WordPress contact forms such as Antispam Bee, Akismet and JetPack, which will protect your entire website from spam submissions.
These plugins often work independently of your contact forms and protect your entire website from spam comments and contact form submissions (generally your comments and forms).
They usually match form submissions with blacklists of words, names and email addresses, while some anti-spam form plugins will also help you add a CAPTCHA or other anti-spam method to your form.
Before using any of these anti-spam plugins, you should go through the complete instructions and details, however they’re often the best choice if you’re not tech-savvy.
Conclusion
Hopefully, now you know how to successfully fight spam on your WordPress website, so you can spend your time improving your website’s conversion rate instead of worrying about spambots. By implementing these protective measures, you’ll save time, maintain a cleaner database, and provide a better experience for your legitimate website visitors.
