Contact form spam: what to do, measure by measure

A contact form is open to the whole Internet, and programs find it. First look at what you receive, then add the measures in order of increasing inconvenience for your real visitors: a form checked on the server, a trap field, a limit on bursts, a careful sort of the content, then a bot check. A puzzle to solve is a last resort, not a first reflex.

As of 9 November 2026.

By Thibault Peray, founder of Antisy Sàrl. · All articles

What do you receive in a contact form?

Read through the latest unwanted messages and sort them into three families.

Messages in bulk, written by a program: links, advertising, text unrelated to your business. The measures below are aimed at them.
Unwanted messages typed by hand, from a real browser. No bot check tells them apart from a legitimate message; only the sorting of the content and your inbox deal with them.
Attempts to hijack the form so that it sends mail to addresses other than yours: see step 1.

See: Glossary: form spam

Step 1: check the form itself

The form must trust nothing it receives.

Validate every field on the server: presence, type, length. A check done in the page by JavaScript protects nothing, a program ignores it.
Fix the recipient in the code. Never take an address, a subject or a header from a field without cleaning it: that is how a form becomes a mail relay.

Step 2: a trap field (honeypot)

A trap field is a field that the layout hides from the visitor. A person leaves it empty; a program that fills in every field completes it, and the submission is recognised as automated. Three precautions avoid refusing a real visitor:

hide it with the layout, and mark it aria-hidden="true" with tabindex="-1", so that a screen reader does not read it and nobody reaches it with the keyboard;
add autocomplete="off": a browser’s autofill sometimes completes fields it thinks it recognises;
give it an ordinary name, not “trap” or “honeypot”.

Its limit: it only stops the programs that fill in every field.

See: Glossary: honeypot

Step 3: slow down the bursts

A program sends fast, and several times in a row. Two limits, to be set on your own messages:

a minimum time between the display of the page and the submission. Set it generously: a browser that pre-fills also saves time;
a maximum number of submissions per source over a period. One address can hide many people, in an office or on a mobile carrier: answer “try again later” rather than banning.

Step 4: filter the content with care

Refusing messages that contain a link is tempting when your form does not expect any. A filter on words is fragile, though: it sometimes refuses a real message. Set doubtful submissions aside to read them again rather than throwing them away.

Step 5: a bot check

A CAPTCHA asks the visitor to prove they are human: ticking a box, recognising images, solving a puzzle. An invisible bot check (sometimes called an “invisible CAPTCHA”) asks nothing and decides from measurements of the browser. The first puts the effort on your real visitors and raises the question of accessibility.

See: Glossary: invisible CAPTCHA · CAPTCHA accessibility: what the WCAG and the W3C say · Bot detection: telling a bot from a human

Where Antisy fits in

Antisy is of this family, for forms. A tag in the page loads the script; at submission, it puts a short token in the hidden field antisy-token; your server sends this token to Antisy with its secret and reads the answer, allow or deny. There are only these two results, and the answer never gives the reason. On deny, refuse the submission without saying why.

Antisy adds to steps 1 to 4, it does not replace them. It does not tell apart unwanted messages typed by hand, does not filter e-mails, never reads the content of the fields, and it announces no detection rate. For a contact form, the call is the simple call; the PHP, Next.js and WordPress guides show where to plug in each piece. There is no WordPress extension.

See: Use case: stopping contact form spam · Guide: protecting a WordPress form · Guide: protecting a PHP form · Guide: protecting a Next.js form · Documentation: if the script does not run · Documentation: when the API does not answer

Where does Antisy stand?

Access is by waiting list. The API and the dashboard have been in service since 27 October 2026, hosted at Infomaniak in Geneva; no customer is in production yet. The pilot started on 9 November 2026 on our own forms.

See: The pilot · Join the waiting list

Frequently asked questions

Do you need a CAPTCHA to stop spam in a contact form?

No. Steps 1 to 4 ask nothing of the visitor, and neither does an invisible check. A CAPTCHA is an option, and it costs those who have to solve it.

How do you stop spam in a WordPress contact form?

With the same steps. A form from a plugin has its own way of receiving and validating a submission: start with its anti-spam settings. For a hand-written form or for comments, the site’s WordPress guide shows where to plug in Antisy’s check. It does not cover form plugins, and this point has not been verified.