How to reduce spam in website forms

Public website forms can attract automated submissions, unwanted links and other junk messages. Anti-spam controls help keep incoming enquiries useful and reduce abuse of the systems processing them.

Several complementary approaches

• CAPTCHA or risk assessment. A challenge or automated assessment can help identify suspicious submissions. Choose an approach that works for the audience and test its effect on accessibility and completion rates.
• A honeypot field. A field intended to remain empty can catch some automated submissions. It must not confuse genuine visitors, assistive technology or legitimate browser autofill.
• Rate limits. Limit repeated submissions within a time window. The rules can consider an account, IP address or other context, while allowing for legitimate users sharing a connection.
• Email validation. Checking the format of an address catches some mistakes, but does not prove the person owns the address or that a message is genuine. Where ownership matters, a separate verification step may be needed.

Use more than one signal

No single measure stops all spam. Combining proportionate controls can make abuse harder without putting unnecessary obstacles in front of potential clients. For example, a quiet honeypot and a reasonable rate limit may handle routine abuse, with additional checks for suspicious activity.

Validation and enforcement must also happen on the server. A check that exists only in the browser can be bypassed by a program sending requests directly.

Review the result

Monitor submission volumes and rejected requests so that new patterns can be investigated. Pay attention to genuine enquiries that are blocked as well as spam that gets through.

The aim is a dependable contact channel. Anti-spam protection is one part of that work; it does not replace application security, access controls or careful handling of the information people submit.