Spam inquiries · CAPTCHA

How can I stop spam on my contact form?

Spam protection works best when you layer several methods instead of relying on one. Start with methods customers never see, and add a CAPTCHA only if spam is still heavy. That order keeps things easy for customers.

Whatever method you use, the server must double-check the result. If you put a CAPTCHA on the page but the server never verifies it, bots simply skip the page and send their messages straight to the server.

Contact forms aren't the only way spam gets in. An email address written in plain text on your website is easy for bots to scrape and add to spam lists. If you must show your email address, offer a contact form alongside it and turn on your email service's spam filter.

How does a honeypot stop spam?

A honeypot hides an input field that people can't see and throws away any inquiry where that field is filled in. People can't see it, so they leave it blank, while bots that auto-fill every field get caught.

The upside is zero hassle, since customers don't have to do anything. But you need to hide the field from assistive technology too, so customers using screen readers don't hear it and fill it in.

Honeypots work well against simple bots, but programs that read pages like a real browser can get around them. That's why they're often used together with rate limiting or a CAPTCHA.

If most of your spam is simple automated advertising, a honeypot plus rate limiting alone can cut it down quite a bit. It causes customers no hassle at all, so it's worth trying before adding a CAPTCHA.

What's the difference between reCAPTCHA and Turnstile?

Both are CAPTCHA services that tell people apart from bots. reCAPTCHA comes from Google and Turnstile from Cloudflare, and both support checking quietly in the background so most customers pass without solving a puzzle.

reCAPTCHA's documentation is moving over to Google Cloud, so its available features and pricing terms may change. Cloudflare says Turnstile can be added even to websites that don't run through Cloudflare. Either way, check the current terms in the official documentation before you set it up.

Both services process visitor information during the check. So when you add one, also review whether your privacy policy needs to mention that you use a third-party service.

In what order should I add spam protection to my contact form?

It's best to first look at what kind of spam you're getting and how much, then add only as much protection as you need. Starting with the strongest measure can block real customers too.

Even after setup, check now and then that real inquiries aren't being blocked. If someone tells you "I sent an inquiry and never heard back," first see whether it got caught by your CAPTCHA settings or content filtering rules.

1. 01Review recent inquiries and note how many spam messages arrive per day and what they say.
2. 02Start with methods customers don't see, like a honeypot and rate limiting.
3. 03If spam is still heavy, add a CAPTCHA such as Turnstile or reCAPTCHA.
4. 04Set up the server to double-check the CAPTCHA result.
5. 05Send a real inquiry yourself from a phone and a computer, and confirm it arrives.
6. 06Also check that inquiry notification emails aren't landing in your spam folder.
7. 07Watch the spam count for a few weeks and adjust your settings.

How do I spot scams hidden in spam inquiries?

Most scam inquiries try to scare you or rush you. Common examples: "We'll sue you for copyright infringement, check the attachment," "We guarantee the #1 spot in search," and "We found a weakness in your website, so pay up."

The goal is often to get you to open an attachment or click a link. Even if the message sounds convincing, don't follow links in it. Verify directly through an official website or phone number you already know.

Scammers usually send the same wording to many businesses. If you search for part of the message, you'll often find posts from other people who received the same thing.

If you've received a suspicious text or email, or already clicked a link, you can call the KISA Boho Nara hotline at 118 for advice. If you have a maintenance provider, let them know too so they can check that your website is OK.

What are common mistakes when setting up spam protection?

The most dangerous mistake is leaving your contact form's "auto-reply email" switched on as is. When a bot submits the form with someone else's email address, your website ends up emailing that person, and your email address can get flagged as a spam sender.

When you hire an agency, ask whether every place that accepts submissions is protected, not just the contact form: booking forms, sign-up and comments too. Google also advises putting safeguards like CAPTCHAs and moderation anywhere users can post content.

If inquiry notifications only go to one main email address, real inquiries easily get buried in spam. Keeping inquiries listed in the admin panel too, or adding a second place to receive notifications, means fewer missed inquiries.

• Adding a CAPTCHA to the page but never verifying it on the server
• Settings so strict that real customers can't send inquiries
• Protecting only the contact form and leaving booking forms, sign-up and comments open
• Auto-reply emails that echo back exactly what the customer wrote
• Never sending a test inquiry yourself after setup