How do I stop spam bots from flooding my contact form?

This page may contain affiliate links from which Blur Studio earns commissions.

Contact form spam is almost never a human typing garbage into your form by hand. It's automated scripts that crawl the web looking for any <form> tag and submit to it blindly, usually trying to get a link indexed somewhere or testing whether the form forwards to an email address worth exploiting later. The fix isn't one tool, it's layering a couple of cheap, low-friction defenses that catch most of it without making real visitors jump through hoops.

If your site collects form submissions through Netlify Forms, the built-in form feature on sites hosted with Netlify, most of these defenses are either already running in the background or a one-line addition rather than a separate tool to install. Worth knowing that upfront, since the spam fix for a Netlify-hosted form is mostly about turning on what's already there, not bolting something new onto it.

Start with a honeypot field, it's nearly free

A honeypot is a form field that's invisible to a real human but visible to a bot scanning your HTML. Bots that auto-fill every field they find will fill in the honeypot; real visitors, who never see it, leave it blank. Any submission where the honeypot field has a value gets silently discarded.

<p class="hidden" style="display:none">
  <label>Don't fill this out if you're human: <input name="bot-field" /></label>
</p>
<input type="hidden" name="form-name" value="contact" />

If you're already using Netlify Forms, add the attribute netlify-honeypot="bot-field" to your form tag (matching the name of your hidden field, no "data-" prefix on this specific attribute) and Netlify handles the filtering automatically, no extra code needed on your end to check the field yourself.

Step up to reCAPTCHA when the honeypot isn't enough

Basic bots fall for a honeypot. More sophisticated ones render the page like a browser would and skip hidden fields deliberately, which is where you'd see spam continue even after adding one. Netlify's documentation points to built-in support for reCAPTCHA v2, Google's "I'm not a robot" checkbox or invisible challenge, added with a single div:

<div data-netlify-recaptcha="true"></div>

This is more visible to a real visitor than a honeypot, since it shows a checkbox or occasionally a puzzle, which adds a small amount of friction. For a quote-request or contact form where you'd rather lose a fraction of a second of visitor goodwill than drown in spam, that tradeoff is usually worth it.

Akismet is already running, whether you knew it or not

Worth knowing before adding anything else: Netlify's own documentation states that all form submissions are already filtered for spam using Akismet, content analysis that scores a submission's text for spam patterns, automatically, on every plan, with zero setup required on your end. This isn't a tool you need to add, it's already part of Netlify Forms' default behavior sitting underneath the honeypot and reCAPTCHA layers you add yourself. If spam keeps getting through despite this, Akismet's automatic filtering has simply missed it, not that it was never active in the first place.

When to reach for something bigger: Cloudflare Turnstile

If you're still seeing meaningful spam after a honeypot, reCAPTCHA and Akismet's automatic filtering, the remaining volume is usually either a targeted attack on your specific site or a bot sophisticated enough to solve reCAPTCHA challenges reliably, both of which are genuinely harder problems. Cloudflare Turnstile is a newer, more privacy-friendly CAPTCHA alternative that often runs invisibly without showing the visitor a challenge at all, verifying in the background instead. It needs its own small script integration rather than Netlify's one-line attribute, since it isn't a Netlify-native feature, and it's a genuine step up in setup complexity beyond the honeypot and reCAPTCHA. I'd only reach for it once the simpler, already-active layers have genuinely proven insufficient over a few weeks, not pre-emptively.

What I'd actually tell you

Start with the honeypot. It costs you nothing, no visitor ever sees it, and in practice it stops the bulk of casual spam because most bots are dumb and generic, not targeting your specific site. Add reCAPTCHA on top if spam continues, accept the small friction cost, and only go further than that if you're still dealing with a genuine, ongoing problem after both are in place. The mistake I see most often is businesses jumping straight to the heaviest tool available out of frustration, when a honeypot alone would have solved 80% of what was annoying them.

One thing worth setting expectations on honestly: Netlify's own documentation doesn't promise zero spam with any of these, and neither will any competing tool. The goal is reducing spam to a manageable trickle you can ignore, not eliminating it completely. If you're checking your form submissions and seeing one or two obvious spam entries a week instead of fifty a day, the layers are working, even if the number isn't literally zero.

A worked example: a tradesperson's form going from 40 spam entries a day to almost none

Say a solo tradesperson's quote request form, hosted on a simple Netlify site, starts getting flooded with roughly 40 spam submissions a day a few months after launch, mostly generic bot traffic rather than anything targeted. Checking the form inbox has become a genuine chore, scanning past dozens of obvious junk entries to find the one or two real quote requests mixed in, which is exactly the kind of friction that eventually leads to someone just stopping checking the form altogether and missing a real lead as a result. Adding the honeypot field alone, a five-minute change requiring no new tools or accounts, drops the daily spam count to a handful, since most of what was hitting the form was unsophisticated bot traffic that dutifully filled in every field it found, including the hidden one. Adding reCAPTCHA v2 on top brings it down further still, to roughly one or two a week, a volume easily ignored rather than one that trains anyone to stop checking the inbox entirely.

Common mistakes when fighting form spam

• Jumping straight to the heaviest tool out of frustration. Reaching for Cloudflare Turnstile before trying a honeypot and reCAPTCHA means taking on real setup complexity for a problem a five-minute change (plus the Akismet filtering that's already running by default) might have solved on its own.
• Making the honeypot field too obvious in the page's visible structure. A more sophisticated bot that actually renders the page can sometimes detect a poorly hidden honeypot field if its CSS is too simplistic; using genuine off-screen or zero-opacity styling rather than a crude display:none that some bots specifically check for improves its effectiveness slightly.
• Checking spam counts once and never again. Spam patterns shift over time as bot operators adjust their scripts; what stopped nearly everything on launch day can gradually become less effective months later, so it's worth periodically glancing at what's getting through rather than assuming the initial setup stays effective forever unchanged.

A quick note on legitimate submissions that look like spam

Occasionally a genuine customer submission gets flagged incorrectly, usually because they filled out the form unusually fast (perhaps using a password manager's autofill) in a way that resembles bot behavior to a spam filter. Before assuming every filtered submission is genuinely spam, it's worth occasionally reviewing what's being caught, especially in the early weeks after adding a new filter, to confirm real inquiries aren't being silently discarded along with the actual junk. A spam filter that's too aggressive and costs you a real lead is arguably worse than the spam problem it was meant to solve.

How I'd approach this

For almost every business asking this, the honeypot plus reCAPTCHA combination through Netlify's own built-in options is genuinely enough, and it's a five-minute change, not a project. Where I'd actually get involved is if spam is specifically targeted at your business (a competitor, a disgruntled party) rather than generic bot traffic, since that calls for a different, more deliberate response than a standard spam filter, or if you need the form's submission processing to route through custom logic anyway for other reasons, in which case adding stronger filtering at that same point costs little extra.