The site is live, the form works, and a couple of weeks later odd requests start pouring into your inbox or Telegram: links to dubious pages, random letters, offers to "promote your site". This is not a hack, just ordinary bots that crawl the web and fill in every form they find.
There are several ways to fight them. The obvious one, a captcha on every form, annoys real visitors and sometimes scares them off. Below are the options and how to combine them so spam is filtered out while clients still send requests with no extra effort.
Why spam is more than an annoyance
A couple of junk requests a day seems minor. But a real one is easy to miss among them, especially when requests go to a shared chat. People get used to scrolling past notifications, and a real client gets lost in the noise.
There is a technical side too. If the form sends emails from your domain, mass spam through it hurts the domain reputation with mail services, and your normal emails start landing in recipients' spam folders more often.
Invisible traps
The first layer of protection is something visitors never notice. The form gets a hidden field that a person cannot see and leaves empty, while a simple bot fills it because it reads the page code. A request with that field filled is dropped.
A timing check works alongside it: a person needs at least a few seconds to read the form and type, while a bot submits instantly. A submission that comes too fast can be treated as suspicious.
These two tricks stop most primitive bots and cost the visitor nothing.
Server-side checks
Anything checked only in the browser can be bypassed by a bot that sends the request directly. So the main rules have to run on the server:
- A limit on how many submissions one address can send in a short time
- Checking the format of the phone and email, not just that the field has text
- Filtering messages that contain only links instead of a question
- Logging suspicious requests to a separate list instead of deleting them, so you can check nothing real was filtered
When a captcha is still needed
If invisible traps and server checks are not enough, a captcha gets added. Modern options mostly work without puzzles: the service looks at visitor behaviour and only shows a challenge to those who look suspicious.
Turn the captcha on where spam actually comes in, not on every form at once. And check how it looks on a phone: a bulky block under the submit button can hurt more than the spam itself.
How not to lose real requests
Any filter makes mistakes now and then. After turning protection on, send a few test requests from a phone and a computer, filled in different ways. Look through the filtered list from time to time: if a real client ended up there, the rule needs loosening.
Other reasons requests go missing are covered separately: why site form requests go missing.
Form protection is usually set up together with sending requests to Telegram, and that pairing is part of Telegram lead delivery. If spam is already getting in the way, get in touch.