Guides · Your inbox

How to stop contact form spam

Bots and hand-typed pitches need different fixes. A hidden field stops most bots; only reading the message stops the pitches a captcha lets through.

  • 6 minutes
  • Works with any form
  • Free for 250 messages a month
Create your inboxJump to the steps

Updated

Step 1 of 40%

Make this guide yours

Type your email and we create your inbox, ready for the steps below. No password, no card.

Contact form spam comes in two kinds, and most fixes only stop the first.

  • Bots find forms and fill in every field: links, gibberish, crypto, the same text on thousands of sites. Cheap checks stop most of them.
  • People, or tools that act like them, type a pitch by hand: SEO services, guest posts, a website redesign, "I noticed a few issues with your site". A captcha doesn't stop them, because a person is there to solve it.
  1. 1

    Stopping bots

    A hidden field. Add an input people never see. Bots fill in every field they find; people leave it empty. Drop any submission where it has a value.

    HTML
    <input name="_honey" style="display:none" tabindex="-1" autocomplete="off">

    tabindex="-1" keeps it out of keyboard navigation, and autocomplete="off" stops a browser from filling it in for a real visitor. This one field costs your visitors nothing and stops a large share of bot traffic.

    Checks on what's sent. A message that's mostly links is rarely from a customer. An email address from a throwaway-mail service rarely belongs to someone who wants an answer.

    A captcha, if you still need one. A captcha or a challenge like Cloudflare Turnstile stops automated bots that get past the hidden field. It also asks every real visitor to prove themselves, and some give up. Try the cheap checks first.

  2. 2

    Stopping the hand-typed kind

    Nothing about the form tells these apart: a person typed the message, in a real browser, with a real email address. The only way to catch them is to read what they wrote.

    • Read the message, not the form. An SEO pitch, a guest-post offer and a crypto scheme each read like what they are. A filter that reads the text catches them; a filter that only checks the form can't.
    • Catch the blast. The same pitch is pasted into many sites' forms within hours, under different names. Seen across many forms at once, it stands out.
    • Don't reply. An answer tells the sender your form is read, and the next pitch follows.
  3. 3

    Where spam should go

    Not straight to the bin. Every filter makes mistakes, and a real lead can read like a pitch. Spam should go to a folder you can check, with the reason it was caught, for a few weeks.

    Not to you either. Spam shouldn't be emailed to you, forwarded to a colleague, posted to Slack or answered. And when the filter gets one wrong, correcting it should be one press.

  4. 4

    How InboxPanda does it

    Every form that posts to InboxPanda gets all of this, on every plan:

    1. 1

      The hidden field. The install code has it, as _honey. Submissions that fill it in are dropped.

    2. 2

      Cheap checks first. Link counts and disposable email domains stop the obvious bots before anything reads them.

    3. 3

      Panda reads the rest. Each message that gets through is read once and labeled. Hand-typed SEO, guest-post and crypto pitches are labeled spam.

    4. 4

      Blasts. The same pitch pasted into many sites' forms at once is caught as a blast.

    5. 5

      Email too. Mail forwarded to your inbox also gets the mail server's own spam scan.

    Spam goes to the Spam folder with the reason. It's never emailed to you, sent to Slack or your webhook, forwarded or answered, and it doesn't count toward your monthly messages. Not spam brings a message back and trusts its sender from then on. Spam is deleted after 30 days.

Questions

Do I need a captcha on my contact form?

Usually not. A hidden field and checks on what's sent stop most bots without asking anything of your visitors. Add a captcha only if bot spam still gets through, and know it won't stop the hand-typed kind.

Why do I get the same SEO pitch from different names?

It's one campaign pasted into many forms, often by people paid per form. The names and addresses change; the pitch doesn't. That's what makes it catchable as a blast.

Will a spam filter block real customers?

Sometimes, which is why spam should go to a folder you can check, not the bin. In InboxPanda, press Not spam and that sender's next messages skip the spam checks.

Does spam count toward my InboxPanda plan?

No. Only real messages count toward your monthly messages.

Keep going

All guides