{"id":18926,"date":"2026-10-21T20:17:41","date_gmt":"2026-10-21T17:17:41","guid":{"rendered":"https:\/\/www.hyyat.com\/knowledgebase\/protect-contact-form-from-spam\/"},"modified":"2026-10-21T20:17:53","modified_gmt":"2026-10-21T17:17:53","password":"","slug":"protect-contact-form-from-spam","status":"publish","type":"docs","link":"https:\/\/www.hyyat.com\/en\/knowledgebase\/protect-contact-form-from-spam\/","title":{"rendered":"How to Protect Your Website Contact Form from Spam and Bots"},"content":{"rendered":"
\n
In short<\/b>Bots hunt for contact, sign-up and comment forms and use them to send thousands of spam messages and links. This floods your inbox and can push your domain\u2019s email into spam folders. Stop them with a hidden honeypot field, a light CAPTCHA, submission limits and a content filter, and never send automatic replies to an address the visitor types.<\/div>\n
\"Spam<\/figure>\n

Why do spammers target your form?<\/h2>\n
\n
1<\/i>Posting links<\/b>Ads or scam links, hoping they get published in comments.<\/span><\/div>\n
2<\/i>Abusing your email<\/b>If the form sends the visitor a copy, the attacker types the victim\u2019s address and your site sends the spam for them.<\/span><\/div>\n
3<\/i>Fake accounts<\/b>Automated sign-ups in your store or forum.<\/span><\/div>\n
4<\/i>Probing for flaws<\/b>Sending code instead of text, looking for flaws such as XSS<\/a>.<\/span><\/div>\n<\/div>\n

7 ways to protect your form<\/h2>\n
    \n
  1. Honeypot field:<\/b> A field hidden from visitors that only bots see and fill, so the submission is rejected automatically. Most form plugins support it, and visitors never notice.<\/li>\n
  2. A light CAPTCHA:<\/b> Such as Cloudflare Turnstile or Google reCAPTCHA v3, which usually run in the background without image puzzles.<\/li>\n
  3. Time and rate limits:<\/b> Reject submissions sent a second after the page opens, and limit messages per address.<\/li>\n
  4. A content filter:<\/b> A plugin such as Akismet, or rules that reject messages full of links or spam words.<\/li>\n
  5. Do not send the visitor a copy:<\/b> \u201cSend me a copy\u201d or auto-replies to an address the visitor types turn your form into a spam tool. Turn them off.<\/li>\n
  6. Send from an address on your domain:<\/b> Make the sender a real mailbox on your domain and put the visitor\u2019s address in Reply-To. This protects your domain\u2019s reputation.<\/li>\n
  7. Keep your form plugin updated:<\/b> An outdated plugin may allow file uploads or code execution.<\/li>\n<\/ol>\n
    Do not publish your email as plain text:<\/b> bots harvest addresses shown on pages and spam them directly. Use the form instead.<\/div>\n

    Which verification should you choose?<\/h2>\n
    \n\n\n\n\n\n\n\n
    Method<\/th>\nPros<\/th>\nNotes<\/th>\n<\/tr>\n<\/thead>\n
    Honeypot field<\/td>\nInvisible to visitors and easy to enable.<\/td>\nStops simple bots only.<\/td>\n<\/tr>\n
    Cloudflare Turnstile<\/td>\nLightweight, usually no image puzzles.<\/td>\nNeeds free keys from a Cloudflare account.<\/td>\n<\/tr>\n
    Google reCAPTCHA v3<\/td>\nRuns in the background and scores each visitor.<\/td>\nNeeds the right score threshold so real visitors are not rejected.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
    \n

    How Hyyat Host protects your site<\/h2>\n