Your contact form is full of spam. Here is why, and how to stop it.

Where the spam comes from

Almost none of it is a person typing. The overwhelming majority of form spam is sent by bots, which are simple programs that crawl the web looking for pages with a form on them. When one finds yours, it reads the form's fields from the page code and submits whatever it was built to send: link-building pitches, fake quote requests, phishing bait, or plain gibberish used to test whether the form works before a bigger run.

The part most owners do not know is what happens next. Once a crawler confirms your form accepts submissions, the address of that form often ends up on shared lists that circulate among spam operations. That is why the pattern is so consistent: a site runs quietly for months, then spam starts and never stops. The form was harvested. You did not do anything wrong, and it will not fade on its own.

A smaller slice is human spam, usually overseas workers paid tiny amounts to submit pitches by hand. This slice matters because it defeats bot-only defenses, and it is the reason no single trick gets you to zero.

Why spam costs more than annoyance

The real damage is not the deleting. It is the real inquiry that drowns. When your inbox trains you that messages from the website are junk, you stop opening them quickly, and speed is the whole game with leads. On our homepage we cite an analysis of 130,175 calls to home service businesses in which 74.1% went unanswered, and research consistently finds that responding within five minutes makes you dramatically more likely to reach the lead, on the order of 100 times versus waiting half an hour. A buried form message gets the slow response by default. The customer who wrote it has three other tabs open, and one of your competitors answers first.

There is a second cost: some owners get so tired of the junk that they remove the form entirely. That trades a solvable nuisance for a permanent hole in the boat, because plenty of customers, especially younger ones, will write before they will call.

What you can do yourself, starting today

Several defenses are free and require no product at all, just whoever maintains your site. Each one blocks a different class of junk, which is why the good setups layer them rather than picking one.

A honeypot field

Add a field to the form that is hidden from human visitors by the page styling. People never fill it in because they never see it. Bots fill in every field they find in the code, including the hidden one. Any submission where the hidden field has content came from a machine and can be dropped. This one change kills the dumbest half of bot traffic and costs your customers nothing.

A timing check

Record when the form loads and when it is submitted. A human takes at least fifteen or twenty seconds to read a page and write a message. A bot submits in under two. Rejecting submissions that arrive impossibly fast catches most scripted traffic, again invisibly.

Blocking the obvious keywords

A large share of spam pitches the same things: cheap SEO, crypto, loans, link exchanges. A short list of phrases that send a message to a junk folder instead of your inbox cleans up most of what the first two checks miss. Keep the list short and review the junk folder occasionally, because keyword lists are the one layer that can catch a real person.

The CAPTCHA trade-off

CAPTCHA is the fix everyone reaches for, and it works, but read the price tag. Every checkbox, puzzle and traffic-light grid adds friction at the exact moment a customer is deciding whether you are worth the effort. Some percentage of real people fail the puzzle, get annoyed, or simply bail, and on a phone the puzzles are worse. You will never see those lost leads in any report, which is what makes the cost so easy to ignore. Our view: use the invisible layers first, and treat a visible CAPTCHA as a last resort for forms still under heavy attack, not a default.

What filtering looks like when it is done properly

The DIY layers above are genuinely worth doing. Where they run out is judgment. A honeypot cannot tell that the same person submitted the same request three times, or that a message which passed every check is still a template pitch, or that your emergency plumbing inquiry deserves a different destination than a question about invoices. Doing this properly means treating the form as a pipeline rather than a mailbox.

A proper pipeline checks each submission several ways at once. It runs the honeypot and timing checks. It scores the message against known junk patterns instead of a single keyword list. It notices duplicates, so a nervous customer who submits twice shows up once, flagged, rather than as two emails. It rate-limits, so a bot hammering the form fifty times an hour gets cut off at the door. And critically, it holds what it rejects instead of deleting, so a wrongly flagged real inquiry is a delay rather than a loss.

Then comes the part spam tools skip entirely: routing. Once only real inquiries get through, they can be sorted by what the customer asked for, so the right kind of job reaches the right inbox or phone. A clean, sorted inbox is what makes the five-minute response possible in practice. Nobody responds in five minutes to a form feed they have learned to distrust.

The works-on-your-site part matters more than it sounds. Most owners in this situation do not want a new website, they want the one they have to stop wasting their time. We point your existing form at our filtering and the checks above start running that day. If you want the whole stack, our Gold plan is $80 a month with a $250 build fee. Gold with all four packages comes to $190 a month; Diamond at $215 adds monitoring, priority changes and monthly numbers, and if you only want the packages we will tell you Gold is the cheaper buy.

The one-hour version of this whole page

If you or your web person have an hour this week: add a honeypot field, add a timing check, and start a small keyword junk list. Those three moves are free and cut the volume hard. Resist the visible CAPTCHA until you have tried them, because the leads it costs you are invisible and real. And if the spam keeps coming, or the real problem is that good inquiries are sitting unread in a messy inbox, that is the point where a $25 a month filter pays for itself with a single saved job.