Tips for Managing Contact Form Spam

Hurrah, an enquiry form has been submitted!

Opens email

Sighhhh.

The above example is a real email from the Brew inbox — the only thing I’ve changed is the URLs. And it’s one of five very similar spammy contact form submissions we received in March. 

This email adds absolutely no value to anyone except helping me show you that if you’re having this issue, you’re not alone. And it is frustrating! 

So, let’s talk about what we can and can’t do about it…

Preventing Automated Spamming is Easy

Spammers use bots to find website forms, fill them with ads/spam/links, and submit them. Because this process is automated, they can do this very quickly and at a large scale. 

Most websites these days have mechanisms to prevent automated spamming, such as delayed check boxes, CAPTCHAs, image selection tests, the honeypot technique, and anti-spam plugins.

I’ve tried many different anti-spam solutions over the years, including a number of honeypot solutions that weren’t very effective. Eventually, I landed on WP Armour, a simple plugin that uses the honeypot technique (with a twist). Because WP Armour uses Javascript instead of PHP it’s much better at blocking spam because bots can’t use Javascript. And it’s also very lightweight in terms of performance. Website users also don’t have to click a captcha checkbox or stress over whether the tip of the bicycle’s handlebar is inside the top square or not.

Preventing Manual Form Spam is Not

The problem with manual form spam (like the example above) is that you can’t stop real people (no matter how dodgy they are) from filling out a form manually. Too many additional barriers will stop real leads and potential customers from contacting you — and you probably don’t want that.

For most businesses, it’s worth letting manual form spammers do their thing. You’ll get the form submission email, identify that it’s spam in under two seconds, and then hit delete. You might have to do this ten times for every one real lead, but the alternative is adding in more steps that could cost you actual enquiries and customers.

Depending on how your business works and how hard you need to come down on manual spam, you could try:

• Blocking certain locations: If you only want to receive contact form submissions from customers in a certain region (e.g. Australia), blocking IP addresses from other countries could cut out a lot of spam.
• Blocking copy and paste in your forms: Customers may have a good reason for copying and pasting information into your forms, so this isn’t ideal.
• Adding more steps: Multiple steps could make your form less appealing to spammers, but they might have the same effect on your customers.
• Using a third-party spam filter: This risks trusting a filter to make the right choices — it may filter out genuine form submissions from customers and leads.
• Implementing two-factor authentication: Require people to verify their identity with a code sent to their phone/email before submitting the form (most people will be put off by this).
• Requiring email verification: This won’t necessarily prevent form submissions, but a verification email that requires someone to click before subscribing can help to keep your email lists clean.
• Keyword filtering: You could use email inbox filters (or other tools) to tag form submissions as spam if they include specific keywords.

Sometimes, Acceptance is Best

You can take a lot of practical steps to avoid automated spam and cut down on manual spam. But no matter what you do, some spam is going to get through. And the more visible your website becomes on the interwebs, the more spam you’ll get. 

Maybe spam is simply an unwanted side effect of owning a successful website?

As for me, I’ve accepted that it will happen and try not to waste too much energy on contact form spam. Sometimes the best tool to deal with spam is the delete button.