You open your website inbox hoping for a new customer. Instead, someone is selling you a suspicious marketing package, three messages contain nonsense, and another promises a business opportunity you definitely did not request.
The temptation is to make your contact form harder to submit. More required fields. A tougher puzzle. Maybe require an account.
Unfortunately, those hurdles can annoy real customers while doing little to stop a determined spammer. A better approach is to identify what is reaching you, add protection where it belongs, and check that genuine inquiries still get through.
First, separate spam from inquiries you do not want
These are different problems, and they need different fixes:
- Automated junk: Repeated nonsense, suspicious links, or nearly identical submissions arriving in bursts. These patterns suggest automation, although appearance alone does not prove it.
- Unsolicited sales pitches: People or bots using your customer form to sell you something. A bot challenge will not necessarily stop a person submitting a pitch manually.
- Poor-fit inquiries: Real people asking for a service you do not offer, work outside your service area, or a project below your minimum scope.
- Unusual but legitimate inquiries: Brief messages, typos, unfamiliar email addresses, or customers writing in a second language. None of these automatically means spam.
Review a manageable sample of recent submissions. Label each as genuine, poor fit, obvious spam, or uncertain. Keep uncertain messages available for human review rather than quietly deleting them.
If most unwanted inquiries are real but unsuitable, fix your service description, geographic coverage, or project requirements. A security tool cannot explain your business better for you.
Find out whether the junk actually came through your form
Spam in your inbox is not always contact-form spam. Someone may simply be emailing the address published on your website.
Ask your website provider to compare a few unwanted messages with the form's submission records, if available. Use timestamps or submission references to check for a match. An email subject that says “New website inquiry” is not proof by itself.
If the junk went directly to your mailbox, changing the form will not solve that problem. Review mailbox filtering separately. If it came through the form, identify which form and which receiving system were involved.
Also ask whether a website form, booking tool, and CRM form have separate protections. Fixing one does not automatically protect the others.
Keep the customer-facing form reasonable
Start with the information your team genuinely needs to respond. For many service businesses, that means a name, one usable contact method, the service requested, and a short description.
Add a qualification question only when it changes what happens next. A cleaning company might need a postal code to check coverage. A commercial consultant might need a company name. Neither necessarily needs a full street address at the first hello.
Do not require a work email simply to reject free email accounts. Plenty of legitimate small-business owners use them. Likewise, an optional phone field should not become mandatory just because your inbox is messy.
For an illustrative cleaning-business form, the useful change might be a service selector and postal code, not six extra questions. Those fields help route and qualify the inquiry. Spam protection can work separately behind the scenes.
Add protection in layers, not one giant obstacle
Your provider should choose measures that suit your platform and the abuse you are seeing. You do not need every option switched on at maximum strength.
Validate submissions on the server
Checks in a visitor's browser are helpful for showing errors, but automated requests can bypass them. The system receiving the submission should also check required fields, sensible length limits, and permitted input formats before accepting or forwarding it.
If your form uses a bot-protection service, its verification must be checked on the server too. A badge on the page is not proof that protection is working.
Use low-friction signals carefully
A honeypot is an extra field designed to attract automated submissions while staying out of a real visitor's way. It can catch some basic bots, but it must be implemented so keyboard users, screen readers, and browser autofill do not accidentally trigger it.
Submission timing can provide another signal. An unusually fast completion may be suspicious, but a customer using autofill can also be quick. Timing alone should not decide whether an inquiry gets discarded.
Limit bursts without banning everyone nearby
Rate limiting restricts how frequently submissions can be accepted. It can help with repeated requests, but aggressive limits can affect legitimate visitors sharing an internet connection, such as people in an office.
Ask your provider how limits are chosen, what a blocked visitor sees, and how someone can retry. Avoid blanket location blocks unless there is a clear business and security reason. Customers travel and use VPNs.
Add a challenge when the lighter measures are insufficient
A managed bot check or CAPTCHA may help, but it can also introduce accessibility, privacy, and loading concerns. Third-party scripts may be blocked or fail to load.
Ask what happens in those situations. A genuine visitor should receive a clear explanation and an alternative contact route, not a submit button that does nothing. Review any new third-party data processing and privacy-notice requirements with the appropriate adviser.
Quarantine doubtful messages instead of losing them
Not every suspicious submission deserves the same treatment. Your provider may be able to reject clearly invalid requests while putting borderline messages into a restricted review queue.
Assign someone to check that queue on a schedule your team can maintain. During an initial rollout, daily review on business days can help uncover rules that are too strict.
For accepted inquiries, tell the customer what happened and when to expect a response. For a blocked attempt, provide a useful error and another way to reach you. Do not display “Message sent” if the system knows it rejected the request.
Keep retained submission data limited to what you need, restrict access, and agree on a deletion schedule. Avoid copying message contents, email addresses, or phone numbers into general website analytics.
Test the protections like a customer, not just an administrator
Before calling the job done, submit clearly labeled test inquiries through the live customer journey. Coordinate with your team so tests are not mistaken for real prospects.
- Submit from a phone using autofill.
- Complete the form using only a keyboard.
- Try a short but legitimate message and an email address from a common free provider.
- Leave an optional field blank.
- Check that validation errors explain the fix and preserve what you already entered.
- Confirm that the submission reaches the intended inbox or CRM.
- Ask your provider to test challenge failures and rate limits in a controlled environment.
Any change that makes junk disappear should trigger one extra question: did real inquiries disappear too?
Measure useful inquiries, not just a quieter inbox
Keep a simple weekly record of obvious spam, genuine inquiries, poor-fit inquiries, and genuine messages recovered from quarantine. Record the date each protection changed.
Compare these figures with your normal inquiry pattern and any changes in traffic or advertising. A drop in submissions is not automatically success. On a low-volume website, review individual inquiries and repeat test submissions rather than drawing big conclusions from percentages.
The goal is less time sorting junk while preserving a dependable path for customers. Zero spam is not a sensible victory if nobody can contact you.
Give your provider a focused repair brief
You can send this request:
“Our website inbox is receiving unwanted submissions. Please confirm which ones came through our forms, review the current server-side validation and spam controls, and recommend the least disruptive changes. Explain how doubtful messages will be reviewed, what blocked customers will see, and how we will test that legitimate inquiries still arrive. Please include any new service costs or ongoing maintenance.”
Start with one affected form, record what changed, and review the results before applying stricter rules everywhere.
Request a Website Review from SolcoMedia if you want help assessing the balance between spam protection and a contact path real customers can use. Bring the form URL and a few redacted examples of the unwanted submissions.
