form spam
Form spam is junk or malicious submissions sent through a website's contact or enquiry form by automated scripts rather than real customers, and left unchecked it can bury or damage genuine leads.
Form spam is what happens when a contact form, built to let real customers reach you, gets found by automated scripts instead. Those scripts submit forms across the internet in bulk, sometimes advertising something unrelated, sometimes just testing whether the form can be tricked into doing something it should not. Either way, none of it is from someone who wants your business.
It is one of the most predictable problems on any public website, because a form that accepts input from anyone is, by definition, reachable by anything, including software built specifically to find and abuse forms like it. A brand-new site with barely any visitors can still get hit within days of going live, because the scripts are not looking for you specifically. They are sweeping the whole internet.
Why it matters to you
The direct cost is noise. If your enquiry form gets even a few automated submissions a day, sorting the real leads from the junk becomes a chore, and it is exactly the kind of chore that leads to a genuine enquiry getting missed or deleted by mistake in the middle of clearing out spam.
The less obvious cost is that a form left open to abuse is also open to more than spam. The same lack of protection that lets junk submissions through can let through submissions crafted to probe the system behind the form for a weakness. Form spam is often the visible surface of a form that has no defence at all.
How I set it up
Every form I build that accepts input from the public gets a bot check, which stops the overwhelming majority of automated submissions before they are even processed, and validation on the server side that rejects anything malformed or clearly not a real enquiry. This runs alongside a WAF, which looks at the request itself for signs it is not coming from a normal browser being used by a person.
I do not rely on filtering spam out after the fact, in an inbox or a spreadsheet. The goal is that spam never gets processed as a lead in the first place, so lead capture only ever records genuine enquiries.
What it looks like in practice
On a site with these protections in place, the enquiries that land in your inbox are the enquiries that matter. You are not scrolling past junk to find the one real message, and you are not wondering whether a submission you deleted was actually a customer. The form does the filtering before anything reaches you, which is the whole point of building it that way from the start.
Questions I get about this
- How would I even know if I was getting form spam?
- Usually it shows up as strange, generic messages in your inbox, links to unrelated products, or enquiries that clearly were not written by a person who read your site. If it is bad enough, real enquiries start getting lost among them.
- Can form spam actually harm my site, or is it just annoying?
- Both. At a minimum it wastes your time and clutters your inbox. At worst, some spam submissions are attempts to find a weakness in how the form processes input, which is a security problem, not just noise.
- Does marking messages as spam in my email fix the problem?
- It treats the symptom, not the cause. The submissions still reach your form, still get processed, and still cost something in the background. Stopping them at the form itself is the actual fix.
Where this fits in our work
Want this set up properly for your business?
This is the kind of thing I build every week. Grab a time and we will talk through what fits.