In shortBots hunt for contact, sign-up and comment forms and use them to send thousands of spam messages and links. This floods your inbox and can push your domain’s email into spam folders. Stop them with a hidden honeypot field, a light CAPTCHA, submission limits and a content filter, and never send automatic replies to an address the visitor types.
Why do spammers target your form? #
1Posting linksAds or scam links, hoping they get published in comments.
2Abusing your emailIf the form sends the visitor a copy, the attacker types the victim’s address and your site sends the spam for them.
3Fake accountsAutomated sign-ups in your store or forum.
4Probing for flawsSending code instead of text, looking for flaws such as XSS.
7 ways to protect your form #
- Honeypot field: A field hidden from visitors that only bots see and fill, so the submission is rejected automatically. Most form plugins support it, and visitors never notice.
- A light CAPTCHA: Such as Cloudflare Turnstile or Google reCAPTCHA v3, which usually run in the background without image puzzles.
- Time and rate limits: Reject submissions sent a second after the page opens, and limit messages per address.
- A content filter: A plugin such as Akismet, or rules that reject messages full of links or spam words.
- Do not send the visitor a copy: “Send me a copy” or auto-replies to an address the visitor types turn your form into a spam tool. Turn them off.
- Send from an address on your domain: Make the sender a real mailbox on your domain and put the visitor’s address in Reply-To. This protects your domain’s reputation.
- Keep your form plugin updated: An outdated plugin may allow file uploads or code execution.
Do not publish your email as plain text: bots harvest addresses shown on pages and spam them directly. Use the form instead.
Which verification should you choose? #
| Method | Pros | Notes |
|---|---|---|
| Honeypot field | Invisible to visitors and easy to enable. | Stops simple bots only. |
| Cloudflare Turnstile | Lightweight, usually no image puzzles. | Needs free keys from a Cloudflare account. |
| Google reCAPTCHA v3 | Runs in the background and scores each visitor. | Needs the right score threshold so real visitors are not rejected. |
How Hyyat Host protects your site #
- Imunify360 blocks addresses known for attacks and spam at the server level.
- Hosting email scans incoming and outgoing messages and limits spam sending. Learn how to combat spam email.
- Alerts when sending from your account spikes, so we can help you stop the source quickly.
Frequently asked questions #
Why do I still get spam with a CAPTCHA?
Some messages come from real people or advanced bots. Add a honeypot field and a content filter alongside the CAPTCHA.
Can form spam affect my domain’s email?
Yes, if the form sends messages to addresses visitors type. Turn off automatic copies and send from a mailbox on your domain.
Does a CAPTCHA annoy visitors?
Modern ones such as Turnstile and reCAPTCHA v3 usually run in the background, so most visitors never notice.
