Contact form spam comes from three places:

Bots that fill in every field they find on the page.

Scripts that POST straight to your form's URL , never loading the page at all.

People and AI tools writing real-looking messages : SEO offers, "I noticed your website…" pitches, crypto and loan offers.

Each defense below stops some of these and misses others. The cheap ones go first.

1. Honeypot field

Add a field that people never see. Bots fill it in; people leave it empty. If it has a value, drop the submission.

<div class= "hp" aria-hidden= "true" > <label> Leave this empty <input type= "text" name= "website_url" tabindex= "-1" autocomplete= "off" ></label> </div>

<style> .hp { position : absolute ; left : -10000px ; width : 1px ; height : 1px ; overflow : hidden ; } </style>

Enter fullscreen mode

Exit fullscreen mode

Tips:

Use a believable name like website_url or company_fax .…