To stop spam submissions on WordPress contact forms without losing real inquiries, add defenses in layers, starting with the least intrusive. Update your plugins, add a honeypot and time check, then an invisible challenge such as Cloudflare Turnstile, then a spam filter. Save every entry in your database and test with real submissions.
Contact form spam is unwanted automated or manual junk sent through a website form, usually by bots promoting links or scams or probing for weaknesses. The aim is not to block everything. It is to block junk while every genuine customer message still reaches you.
This guide uses five steps, in this order:
- Update WordPress and your form plugin, and record your baseline.
- Add a honeypot and a time-based check.
- Add an invisible or low-friction challenge.
- Add spam filtering and careful keyword rules.
- Keep every entry saved so nothing is lost.
A test routine follows the steps so you can confirm real inquiries still arrive.
Key takeaways
- Layer light defenses one at a time, and test after each one, so you know which setting causes a problem.
- Honeypots and time checks stop many bots without asking real visitors to do anything.
- Over-blocking keywords such as “free” or “.com” can reject genuine customers.
- Saving every entry in your WordPress database means a failed email or a wrong filter does not lose a lead.
- A missing inquiry is not always a spam-filter problem; email delivery issues are a common cause.
Why does my WordPress contact form get so much spam?
Your contact form gets spam because bots find forms automatically and submit them in bulk. They do not pick targets by size, so a small business site can be hit as easily as a large one.
Spam is more than an annoyance. Bluehost’s guide to stopping contact form spam in WordPress covers the main ways to block it. Junk entries also bury genuine messages, so a real inquiry is easier to miss. If you also care about wider site protection, our WordPress security report is a useful next read.
Why over-blocking costs you leads
Every spam filter risks false positives, meaning a real message is treated as junk. A lost inquiry can be a lost customer, and you may never know it happened.
That is why this guide adds one layer at a time and tests after each. If something goes wrong, you will know which setting caused it.
Before you start: what you need
You need three things: admin access to WordPress, access to your form plugin’s settings, and a second email address or a phone to test with.
- WordPress admin login
- Access to your form plugin’s settings
- A second email address or a phone for test submissions
Note which form plugin you use. Spam settings differ between plugins, so check your plugin’s own documentation for exact option names.
Step 1: How do you prepare your site and measure your spam baseline?
Update WordPress core, your form plugin and any anti-spam plugins to their current versions, then count your weekly spam entries. Updates often include fixes, and the count gives you a baseline.
Write the weekly number down. This lets you tell whether each later step actually helps.
Step 2: How do you stop spam submissions on WordPress contact forms with a honeypot and time check?
A honeypot and a time-based check are the lowest-friction defenses, because real visitors do not need to do anything. Start here.
A honeypot is a hidden form field that real people do not see but bots often fill in. If the field contains data, the submission is rejected.
A time-based check rejects submissions sent unrealistically fast, since a person needs a few seconds to fill in a form and a bot may not.
Many form plugins offer these options, but confirm in your plugin’s documentation. Enable one setting, then test before moving on.
Does a honeypot block real users?
A honeypot is designed so real users never interact with it, but behaviour can vary by plugin and browser. For example, an autofill tool may fill a hidden field. Check your plugin’s documentation, and test on a desktop and a phone after enabling it.
Step 3: Should you use reCAPTCHA or Cloudflare Turnstile?
Choose an invisible or low-friction challenge first. Google reCAPTCHA v3 and Cloudflare Turnstile are designed to ask little of visitors, while reCAPTCHA v2 uses a visible checkbox.
| Option | What visitors see | Things to check |
|---|---|---|
| Google reCAPTCHA v2 | A visible checkbox | Adds a step for visitors; see Google’s documentation |
| Google reCAPTCHA v3 | Designed to work in the background | Verify score and threshold settings in Google’s documentation |
| Cloudflare Turnstile | Check Cloudflare’s documentation for current behaviour | Follow Cloudflare’s own setup guide and privacy information |
A threshold set too strict can reject real people, so test after setup. Follow the official documentation for whichever service you choose.
Do you need a CAPTCHA at all?
Not always. If the honeypot and time check already cut your spam to a manageable level, you may not need one. Add a challenge only if junk keeps arriving, because every extra layer is another place a real inquiry could fail.
Step 4: How do you add spam filtering and keyword rules safely?
If spam still gets through, add a filter that checks content. Akismet checks submissions against a spam database, and your form plugin may include its own built-in filter as an alternative.
Before using Akismet, check its terms for commercial sites, since the rules may differ from personal use.
How to block a domain or keyword safely
Block specific phrases you have actually seen in your spam, not common words. Blocking “free” or “.com” can reject genuine customers.
- Copy exact phrases from real spam entries into your blocklist.
- Allow some links, since genuine customers sometimes paste a URL.
- Review the spam or quarantine folder regularly to catch false positives.
Step 5: How do you keep every entry saved so nothing is lost?
Save every form entry in your WordPress database. Email notifications can fail, so a stored copy is a safety net when a filter or mail server gets it wrong.
One option is LeadForge Pro, which collects visitor emails and custom inquiries directly into your WordPress database. Check the LeadForge Pro product page for current pricing and licence details.
A stored entry also lets you compare what your filters caught against what actually reached your inbox. If you are comparing tools, see our guides to a free lead capture plugin for WordPress and an email capture plugin for WordPress.
How do you check that real inquiries still arrive after stopping spam?
Run a short test routine after every settings change. Send real test messages and check every place a message could end up.
- Submit a normal message from a desktop computer.
- Submit a normal message from a phone.
- Send a message that contains a link.
- Send a message in a non-English language.
- Check your form plugin’s spam or quarantine folder.
- Check your email spam folder.
To tell delivery problems from filtering: if the entry is saved in your database but no email arrived, suspect email delivery rather than your spam filter. Ask your email or hosting provider to verify an SMTP plugin setup, plus SPF, DKIM and DMARC records.
Backups also help if a change breaks something. A site backup plugin for WordPress lets you restore a working setup.
Ongoing maintenance: weekly review at first
Review your spam folder and saved entries weekly at first. Compare the spam count with your baseline, and loosen any rule that flags real messages. Once things are stable, a monthly check is usually enough.
Common mistakes to avoid
- Turning on every defense at once, so you cannot tell which one causes a problem.
- Blocking common words or extensions such as “free” or “.com”.
- Setting a challenge threshold too strict and never testing it.
- Assuming a missing inquiry is a spam-filter issue when email delivery is the cause.
- Never checking the spam or quarantine folder.
Frequently asked questions
What is the best way to stop contact form spam in WordPress?
Use layers. Start with a honeypot and time check, add Cloudflare Turnstile or reCAPTCHA v3 if needed, then a spam filter. Test after each step.
Is reCAPTCHA or Cloudflare Turnstile better for contact forms?
Both can work. Compare them using Google’s and Cloudflare’s own documentation, including privacy information and setup. With reCAPTCHA v3, check the score threshold so real visitors are not rejected.
Will anti-spam tools block genuine inquiries?
They can. Strict thresholds and broad keyword rules cause false positives. Test with real submissions and review your spam folder regularly.
Why are real form emails not arriving?
Email delivery is a common cause. If the entry is saved in your database but no email arrived, check your SMTP plugin, SPF, DKIM and DMARC with your email or hosting provider.
Should I store form entries in the database as a backup?
Yes. A database copy means a failed email or a wrong filter does not lose a lead. Check that your form plugin or a lead tool saves entries, and confirm it before relying on it.
Conclusion
Stopping spam without losing leads comes down to adding light defenses one at a time, saving every entry and testing after each change. Start today by recording your weekly spam count, then enable a honeypot.
If you want entries stored in your WordPress database, you can view LeadForge Pro.
Found this useful? Share it: WhatsApp
