Why Your Website Contact Form Is Sending Spam and How to Stop It

Summary

This guide helps you troubleshoot and resolve: Why Your Website Contact Form Is Sending Spam and How to Stop It. Follow the steps below to fix the issue.

Common Causes

Your website contact form is designed to capture genuine enquiries from customers, but it can also become a target for automated bots. When spammers exploit your form, they can send high volumes of junk messages through your server, which may result in your domain being blacklisted and your legitimate emails landing in spam folders. This guide explains how to identify form abuse and secure your website against automated attacks.

Quick Fix Steps

1. Log in to your website admin dashboard and review all recent form submissions.
2. Delete any obvious spam entries and note the IP addresses or email patterns used.
3. Install or enable a CAPTCHA solution on your contact form.
4. Test the form by submitting a genuine enquiry to confirm it still works.
5. Monitor your email delivery and spam folder over the next 24–48 hours.

Detailed Instructions

Identify Spam Submissions

1. Open your website admin panel and navigate to the contact form or messages section.
2. Look for submissions containing random characters, multiple links, or generic text such as "Great post!" or "Contact me about SEO services."
3. Check the submission timestamps. Bots often send multiple entries within seconds or minutes of each other.
4. Export the submission list if your platform supports it, so you can analyse patterns in IP addresses or email domains.

Add CAPTCHA Protection

1. For WordPress sites, go to Plugins > Add New and search for a reputable CAPTCHA plugin such as reCAPTCHA or hCaptcha.
2. Install and activate the plugin, then follow the setup wizard to obtain API keys from Google reCAPTCHA or hCaptcha.
3. Edit your contact form page and add the CAPTCHA field to the form.
4. Save the form settings and test by attempting a submission without completing the CAPTCHA. The submission should be blocked.
5. For non-WordPress sites, add the CAPTCHA script provided by your service to your form HTML, usually just before the closing form tag.

Enable Honeypot Fields

1. A honeypot is a hidden field that humans cannot see but bots often fill out automatically.
2. In your form builder settings, look for an option labelled Enable Honeypot, Anti-spam field, or similar.
3. Activate the option and save your form.
4. Test the form to ensure genuine submissions still go through while bot submissions are rejected.

Review Email Sending Settings

1. Ensure your website is not using the default PHP mail() function to send form notifications, as this is easily abused.
2. Configure your site to send emails via SMTP using your 220 Internet Services mail credentials or a dedicated transactional email service.
3. In your website admin, navigate to Settings > Email or SMTP and enter your mail server details.
4. Save the settings and send a test email to confirm delivery.

Troubleshooting

Spam Continues After Adding CAPTCHA

• Verify the CAPTCHA is actually displaying on the live form. Clear your website cache and browser cache, then reload the page.
• Ensure you entered the correct site key and secret key in your plugin settings.
• Try switching from reCAPTCHA v2 to v3, or vice versa, depending on your traffic patterns.

Genuine Emails Are Going to Spam

• Check if your domain has been added to an email blacklist using a free lookup tool.
• Review your SPF, DKIM, and DMARC records in your DNS settings. Missing or incorrect records can cause mail providers to reject your messages.
• Ask your web developer to confirm your website is sending from an authorised mail server, not a generic web server address.

Contact Form Is Not Sending Any Emails

• Confirm your SMTP credentials are correct and that your mailbox is not over quota.
• Check your website error logs for messages related to mail delivery.
• Temporarily disable any new security plugins to see if they are blocking form submissions.

If your email domain has been blacklisted due to high spam volume, clearing the form alone may not restore delivery. You may need to request delisting from blacklist providers and improve your email authentication records.

If you have applied these steps and continue to receive spam or experience email delivery issues, Open a Ticket with our support team for further assistance.

Still Having Issues?