Forms & security
How layered spam protection helps website enquiry forms
Spam protection works best as a set of complementary checks. A visible CAPTCHA is not the only option, and no single check can guarantee that unwanted messages will disappear. The aim is to reduce abuse while allowing real customers to ask a question without unnecessary friction.
Validate everything on the server
Browser checks help visitors correct mistakes, but automated requests can bypass them. The server should validate required fields, lengths, email formatting, and allowed service choices. Fixed notification recipients and careful handling of email headers help prevent a form from becoming an open email relay.
Use low-friction signals first
A honeypot is a field intended to remain empty that some automated tools fill. A form token helps verify that a request belongs to a valid session. Submission timing and origin checks can add useful signals. These checks have different purposes: a valid token alone does not prove that the sender is human.
Limit repeated submissions thoughtfully
Rate limits reduce rapid repeated attempts, but shared networks can place several real people behind one address. Use a reasonable threshold and a clear retry message. Store as little identifying information as needed for the limit, protect it, and remove stale records. Monitor actual patterns before making the rules more restrictive.
Add a challenge when the evidence warrants it
If unwanted submissions continue, a service such as a managed challenge may help, but it introduces a provider and additional privacy and accessibility considerations. Review the real spam pattern first. Keep a legitimate contact route available and retest mobile, keyboard, and error behaviour after any new protection is added.
Your next steps
- Keep server-side checks on every form.
- Use fixed recipients and safe email headers.
- Review repeated attempts and false positives.
- Treat CAPTCHA as an additional layer, not a guarantee.