Why do spammers target contact forms?

Spammers target contact forms because they're publicly accessible entry points that don't require account creation. Most spam is automated: bots are programmed to find forms and submit advertising links, phishing attempts, or malicious scripts. The goal is usually to earn backlinks, collect email addresses, or probe your site for security vulnerabilities.

What are the signs of spam form submissions?

An unusual spike in form submissions is the clearest sign. Bot spam typically includes random text, gibberish keywords, multiple links in a single message, or the same submission repeated from different email addresses. Spam bots also commonly use temporary email addresses, so look for unusual or auto-generated email domains in your submissions.

Can I track the source of spam form submissions?

Yes, you can track the source of spam form submissions in WordPress. WPForms includes a Form Abandonment feature that logs IP addresses from incomplete submissions, which can help identify spam sources. Some WordPress security plugins, including Sucuri and Wordfence, also provide detailed logs showing IP addresses and other information about suspicious submissions.

What are the common signs of spam form submissions?

An unusual increase in form submissions is a clear sign of spam. Spam hints include random text, weird keywords, or jumbled sentences. Spam bots also use many links back to their sites or products, so spotting a surplus of irrelevant links could be a warning that you're dealing with spam. Additionally, spam bots often use temporary emails. Look out for unusual or random strings of characters - they're likely spam.

Stop WordPress Spam Form Submissions: 8 Proven Methods

TL;DR: How to Stop Spam Form Submissions in WordPress

Spam form submissions are preventable. Most WordPress sites need only 2-3 of these methods to eliminate the vast majority of spam. If you run giveaways, Step 2 covers the fraud protection angle that contact form guides miss.

Install an anti-spam plugin: The fastest way to filter spam before it reaches your inbox automatically.
Activate giveaway fraud protection: If you run contests, RafflePress’s built-in email verification and reCAPTCHA stop fake entries.
Enable built-in form protection: WPForms and most modern form plugins include anti-spam tokens you can turn on in one click.
Add reCAPTCHA: Invisible reCAPTCHA v2 is the best balance of protection and user experience for most sites.
Use comment moderation: WordPress’s built-in Discussion settings catch spam before it appears on your site.
Block repeat offender IPs: For persistent spammers, adding their IP to your disallow list stops them at the source.

Spam form submissions are one of the most frustrating problems I’ve had to deal with on WordPress sites. They flood your inbox with junk, waste your time, and make it harder to spot real messages from visitors.

If you’re tired of dealing with fake entries, bot spam, or unwanted messages through your contact forms, this guide will show you how to stop spam form submissions in WordPress using simple, proven methods.

I’ll walk you through how to protect your site using tools like reCAPTCHA, IP blocking, and email filters. These steps are easy to follow and work even if you’re not a tech expert.

What Is a Honeypot Field (And Why Isn't It Enough on Its Own)?
How to Stop Spam Form Submissions

What Is WordPress Form Spam?

WordPress form spam is irrelevant or inappropriate submissions generated by bots. They’re automated systems that flood your site and contact forms with spammy links, advertisements, and unsolicited content.

Why Does Your Site Attract Spam Form Submissions?

Spammers target websites for a variety of reasons. The cost goes beyond annoyance: your inbox fills up with garbage, you start missing real inquiries buried in the noise, and you burn admin time sifting through entries that were never real.

Spam generally falls into three types:

Advertising and backlink spam: The most common. Bots submit links hoping to earn backlinks or get eyes on their product.
Phishing attempts: Messages designed to trick you into clicking a malicious link or sharing credentials.
Malicious code injections: Submissions containing scripts that try to exploit vulnerabilities in how your site handles form data.

Complex bots or human spammers can get past basic captcha-based security. Layering even two of the methods below stops most of them cold.

What Is a Honeypot Field (And Why Isn’t It Enough on Its Own)?

A honeypot field is a hidden form field that’s invisible to human visitors but visible to bots.

When a bot fills out your form, it typically fills in every field it finds, including the hidden honeypot. When your form plugin detects a submission with the honeypot field filled in, it knows it came from a bot and discards it. Humans never see the field, so they never fill it in.

It’s a low-friction option that requires no action from your visitors. The problem is that many modern spam bots can bypass honeypot fields. They’ve evolved to detect hidden fields and leave them empty.

Honeypots still add a small layer of friction, but I wouldn’t rely on one alone. Use it alongside at least one other method from this list for real protection.

The methods below include options for every level of protection, from quick plugin installs to reCAPTCHA and country filtering.

How to Stop Spam Form Submissions

You don’t need to be a developer to protect your site from WordPress form spam. These simple strategies help you block spam bots, fake entries, and repeat offenders, without breaking your forms or hurting conversions.

Step 1: Use an Anti-Spam Plugin to Block WordPress Form Spam

The fastest way to stop spam form submissions is with a reliable anti-spam plugin. These tools automatically detect and filter spam before it ever reaches your inbox.

So, how do you choose the right spam prevention plugin? Here’s what I look for:

Reputation: I look for plugins with thousands of active installs and a 4+ star rating on plugin ratings on WordPress.org. Anything less and you’re gambling on reliability.
Support: You might run into issues even with the best plugins. I want to see a developer who responds to support queries and ships timely updates. An unanswered six-month-old bug report is a red flag.
Features: Look for plugins that cover multiple attack vectors: IP blocking, reCAPTCHA integration, and country-based filtering. A plugin that only does one thing leaves gaps.

Akismet anti-spam plugin reviews on WordPress.org

Some popular and highly trusted plugins include Akismet, Titan Anti-Spam & Security, and Antispam Bee.

Step 2: Stop Spam Form Submissions in Giveaways with RafflePress

If you run contests or giveaways, fake entries can skew your results and hand your prize to a bot. RafflePress has built-in fraud protection with email verification and invisible reCAPTCHA, catching spam entries before they affect your giveaway.

When creating your giveaway, navigate to the Settings panel, and you can activate Recaptcha and invisible Recaptcha.

Invisible Recaptcha doesn’t involve interactive puzzle-solving for the users. Instead, it uses an advanced risk analysis system to decide if it’s a human user or a bot.

You can also require users to verify their email addresses when entering your giveaway. This is a great way to confirm their identity and that they’re actually human beings.

Step 3: Enable Built-In Spam Protection for WordPress Forms

Most modern form plugins include spam protection settings you can enable in just a few clicks. These built-in options are a great way to block bots without needing extra plugins.

WPForms, the best WordPress form builder plugin, has this feature built-in.

WPForms drag and drop WordPress form builder plugin

It provides an added layer of protection against automated bots and malicious users who try to submit spam through contact form submissions. WPForms removed their honeypot field when sophisticated bots started bypassing it reliably, and replaced it with the anti-spam token.

All you need to do is enable the feature in your form settings.

Enable spam protection in WPForms to stop spam form submissions

Behind the scenes, the plugin adds a secret token unique to each submission. Since spambots can’t detect the token, they get stuck and can’t submit the form.

Step 4: Add reCAPTCHA to Prevent Spam Form Submissions

reCAPTCHA is one of the most effective ways to block automated spam bots. It works by detecting user behavior and verifying that form submissions come from real people, not scripts or spammers.

Instead of having just one reCAPTCHA method, WPForms offers a choice of 3:

Checkbox reCAPTCHA v2: Visitors hover their mouse cursor over a checkbox to submit your form. It’s called a ‘challenge’ and usually has the words ‘I am not a robot’ beside it.
Invisible reCAPTCHA v2: Instead of showing a checkbox, this method detects user activity to decide if they’re human. It’s a great way to prevent spam without showing a challenge like a math question.
reCAPTCHA v3: This advanced CAPTCHA uses JavaScript to detect human visitors. It’s a great choice for AMP pages but may sometimes stop real visitors from submitting forms. I suggest using this option only if you’re an advanced user who can troubleshoot issues.

After choosing your reCAPTCHA method, adding your API keys, and going through the authentication process, you can add the reCAPTCHA field to your online form. Field validation can help control fake submissions.

When the form field is in place, you’ll see the reCAPTCHA badge in the form builder preview.

When reCAPTCHA Isn’t Enough

reCAPTCHA blocks the majority of automated spam, but there are cases where it falls short:

UX friction: The v2 checkbox challenge adds a step that some users abandon, which can reduce form completions on high-traffic lead forms.
CAPTCHA farms: Sophisticated spam operations use human workers to solve CAPTCHAs at scale, bypassing even v3 protections.
Cloudflare Turnstile: A friction-free alternative that requires no puzzle-solving or checkbox interaction. It runs a challenge in the background and is widely recommended as a less intrusive option for sites where form conversion rates matter.

Some other popular WordPress plugins with reCAPTCHA features include:

SeedProd – Block spam on your web pages and landing pages
OptinMonster – Prevent spam in your opt-in forms
WP Simple Pay – Protect your payment forms from malicious activity
Easy Digital Downloads – Secure your online store from spam vulnerabilities

Step 5: Filter Comment Spam with WordPress Moderation Settings

Spam doesn’t just target forms; it hits your blog comments too. WordPress includes built-in moderation settings that let you hold suspicious comments for review before they appear publicly.

To enable comment moderation, navigate to Settings » Discussion from your WordPress admin. One of the options you’ll see is ‘Comment Moderation.’

Use Comment Moderation in WordPress to stop spam form submissions

Here, you can specify the number of links or keywords that trigger comment moderation. For example, if you set the value to ‘2’, any comment with more than two links will be held for moderation.

Similarly, if you add specific words to the moderation list, comments containing those words will also be held for your review.

After, click the Save Changes button to apply the settings. From now on, any comment that meets the moderation criteria will be held for your approval before it appears on your website.

Step 6: Block IPs to Stop Repeat WordPress Spam Submissions

If the same spammer keeps coming back, you can block their IP address directly in WordPress. This stops form submissions and comments from that source without affecting the rest of your visitors.

But be cautious: blocking an IP should be your last resort, as it can potentially block legitimate users.

First, you’ll need to identify the IP addresses causing problems. You can find these in your server logs, where all IP addresses interacting with your site are recorded.

Once you have the offending addresses, add them to your comment disallow list. To find it, navigate to Settings » Discussion and scroll down to the Disallowed Comment Keys section.

Block IP addresses in WordPress to stop spam form submissions

Now paste the list of IPs, one per line, and click the Save Changes button. Anyone slipping past your CAPTCHA will now be blocked.

Step 7: Block Spam Emails from Submitting Forms in WordPress

Some spam comes from real people using shady email addresses. With tools like WPForms, you can create an allowlist or denylist to control which email addresses can submit your forms.

To find this feature, head to your forms in the WordPress dashboard and edit a form.

Next, click the email field and expand the Advanced Options heading.

After expanding the menu, click the Allowlist / Denylist dropdown and select your desired option. For this example, we’ll choose the Denylist.

Type the email addresses you want to block in the box beneath the dropdown. You can type the full email or use an asterisk * to create a partial match.

When you have the denylist set up, save the form.

Step 8: Limit Spam Form Entries by Country in WPForms

If your form spam is coming from specific regions, WPForms lets you restrict submissions by country. This can drastically reduce junk entries without blocking your real audience.

Simply edit your form, then toggle the Enable Country Filter option in the spam settings.

From there, you can restrict entries from specific countries or accept submissions only from selected countries.

FAQs About Form Spam

In addition to the tips above, here are some common questions that our readers ask us about form spam.

What is a honeypot field and does it still work?

A honeypot field is a hidden form field that bots fill in but humans never see. When a submission includes the hidden field, your form plugin marks it as spam and discards it.

Honeypots still catch basic bots, but many modern bots are trained to detect and ignore hidden fields. They work best as a secondary layer alongside reCAPTCHA or an anti-spam plugin, not as your only protection.

Does reCAPTCHA v3 actually stop spam bots?

reCAPTCHA v3 assigns a risk score to every form submission based on user behavior. It doesn’t show a challenge to users, which makes it seamless, but it works best when you can set a threshold and decide what score counts as spam.

It’s effective against most automated bots, but it can occasionally flag real visitors with unusual browsing patterns. For most sites, invisible reCAPTCHA v2 is a better starting point because it’s simpler to configure and less likely to cause false positives.

What’s the difference between reCAPTCHA and Cloudflare Turnstile?

Google reCAPTCHA verifies users through behavioral analysis and, in the case of v2, a visible checkbox or puzzle challenge. Cloudflare Turnstile runs a similar background check but requires no visible interaction from the user at all.

Turnstile is a good option if you’re finding that reCAPTCHA’s checkbox is hurting your form completion rates. It’s privacy-focused, doesn’t use Google’s ad network, and increasingly popular as a frictionless alternative.

Why am I getting spam even with reCAPTCHA enabled?

A few things can cause this. Your reCAPTCHA threshold may be set too low, letting borderline submissions through. Some spam also comes from human workers at CAPTCHA farms who solve challenges manually at scale.

If reCAPTCHA alone isn’t enough, adding an anti-spam plugin like Akismet or using WPForms’ built-in anti-spam token gives you a second layer of filtering that catches what reCAPTCHA misses.

How do I know if spam is coming from bots or real people?

Bot spam typically looks like gibberish text, random character strings, multiple links in a single submission, or the same message submitted many times from different email addresses. The email domain is often temporary or auto-generated.

Human spam tends to be more coherent but still off-topic, often advertising a product or asking you to click a suspicious link. If you’re getting repeated submissions from the same source, IP blocking in WordPress can stop them directly.

Prevent WordPress Form Spam Today

Your inbox was getting buried in junk. With these 8 methods in place, you have the tools to stop that. The combination of an anti-spam plugin, reCAPTCHA, and at least one form-level protection covers the vast majority of spam you’ll ever see.

If you run contests or giveaways, RafflePress’s built-in fraud protection handles the hardest part automatically. Email verification and invisible reCAPTCHA mean fake entries never make it into your results.

You might also find the following tips and tutorials useful in maintaining your WordPress site:

If you liked this article, please subscribe to our YouTube Channel for RafflePress video tutorials. You can also find us on Twitter and Facebook.

Stacey Corrin Content Marketing Specialist

Stacey Corrin is a certified content marketing and search specialist with over 15 years of experience writing about WordPress, SEO, and digital marketing. She manages content for SeedProd and RafflePress, covering tools and strategies she actively uses and tests herself.

See Full Bio

How I Stop Spam Form Submissions in WordPress (8 Methods That Work)