Your spam filter is probably deleting real enquiries
Eleven messages arrive overnight. Nine are junk, and the receptionist clears them in one sweep, because she has done this every morning for a year and knows what junk looks like. Message number seven was a new patient with a cracked tooth asking to be seen today. Nobody ever found out.
The short version
Nearly every guide to stopping WordPress contact form spam is written as though spam is the only thing that can go wrong. It is not. The more expensive failure is the real enquiry that never arrives, because a CAPTCHA would not load in somebody’s browser or a filter quietly binned it. Spam costs a glance. A missed enquiry costs your client a customer, and nobody ever finds out. Below: why we stopped reaching for a CAPTCHA first, the layered checks that actually work, and a ten minute test to find out what your own forms are losing.
Message number seven
Picture a Tuesday morning at a small dental practice. The receptionist opens the inbox and finds eleven new messages from the booking form on the website.
Nine are junk. Somebody offering guaranteed five star reviews. Somebody else with a subject line of pure keyboard mash. A quote request for a service the practice does not offer, written in a language nobody there speaks.
She deletes them in a batch. She has done this every morning for a year and she knows what junk looks like.
Message number seven was a new patient with a cracked tooth, asking whether anyone could see her today. She never found out.
We have not met that exact receptionist. We have seen a version of that morning on client sites often enough that it stopped being a story and started being the thing we designed around.
Every contact form is in one of two states
If you look after WordPress sites for other people, you already know both of them.
Wide open. The form has no protection at all, or it has a plugin that stopped being updated in 2021. The client’s inbox becomes a place where real enquiries drown, and eventually somebody stops reading it properly.
Nailed shut. Somebody installed an aggressive filter, or a puzzle that asks visitors to find the traffic lights. Spam drops off a cliff. So do enquiries from people over sixty, people on their phones, and anyone who decided the form was not worth the hassle.
Neither is good. The second is worse, and it is worse in a way that is almost impossible to see from the inside, because the evidence of the problem is precisely the messages you never received.
The asymmetry nobody prices in
Here is the sentence we kept coming back to, and the one worth writing on the wall before you touch any spam setting:
A missed real enquiry costs far more than a spam message somebody has to glance at.
A spam message that gets through costs a glance and a click. A real enquiry that gets blocked costs your client a customer, and not the client, not you, and not the customer will ever know it happened.
Once you accept that, a lot of common advice stops making sense. Tightening the filter until spam reaches zero is not a win. Zero spam and three lost quote requests a month is a significantly worse outcome than four spam messages a day, and it looks better on every dashboard.
Why we stopped reaching for a CAPTCHA first
CAPTCHA is the reflex answer to form spam, and for a long time it was ours too. Three things changed our mind, and none of them is that CAPTCHA is useless.
It fails silently for the people most likely to be privacy conscious
Privacy browsers, tracking protection and ad blockers can block the reCAPTCHA cookie. When that happens the check never completes and the form does not submit. The visitor gets no useful explanation, so what they actually experience is that your client’s website is broken.
Nobody emails to report this. They leave.
It sometimes decides a fast typist is a robot
Scoring systems treat an unusually quick submission as suspicious, which is reasonable until you remember that some people type quickly, and that somebody returning to a form they have filled in before with autofill will look identical to a script.
It does not stop the spam that actually costs you
A lot of modern form spam is not a crude bot. It runs in real browsers, from residential connections, through services built specifically to pass these checks, and sometimes it is typed by a person being paid very little. A challenge that asks whether you are human gets an honest yes from all of them.
So you end up paying the cost of the challenge, in load time, in accessibility and in lost submissions, without getting the protection you bought it for.
What actually stops WordPress contact form spam
The checks that work best are the ones a real visitor never sees. None of them is sufficient alone, which is the whole point.
- A honeypot field. A field hidden from people and visible to scripts. Anything that fills it in is not a person. Free, invisible, and it removes a surprising share of automated traffic.
- A minimum time to submit. A human reads the page before typing. A script posts in under a second. Rejecting submissions that arrive impossibly fast costs nothing to anybody real.
- Server-side validation. Required fields, expected formats and permitted values checked on the server, not only in the browser, because a script never runs your browser code at all.
- Sender reputation. Whether this sender has been confirmed as junk by other people before now. This is the layer that catches the human-typed spam that every technical check passes.
- What the message actually says. Useful as supporting evidence and dangerous as a sole verdict, because a marketing agency genuinely does get asked about SEO all day.
And then the rule that matters more than any individual layer: never set a message aside on one signal. A data centre address is not spam on its own, because plenty of people use a VPN. A link is not spam on its own, because people share links. When two or more independent signals agree, that is a verdict. When only one does, that is a question, and questions should go to a person.
The part a single website cannot see
This is the bit that took us longest to appreciate, and it is the reason a per-site plugin can only get you so far.
A message sent to four thousand forms looks completely ordinary to each one. Good English, a plausible address, a real browser that really did render the page. Every check a single site is able to run, a mass campaign passes, because from where that site is standing there is nothing unusual to see.
One site has one site to compare against, and one is not enough. But if you can see across a whole portfolio, the same pitch landing on a plumber, a solicitor and a bakery in the same afternoon stops being three ordinary messages and becomes what it obviously is.
That is why we built it into contact form submissions rather than shipping another per-site plugin.
How we handle it now
Every connected site’s enquiries land in one list. The filter reads alongside the form plugin rather than replacing it, so nobody has to rip out Gravity Forms or WPForms to get this.
- Every decision is explained in a sentence you can read, not a score out of a hundred you have to interpret
- Nothing is ever deleted. Spam sits behind a filter with its reasons attached, and one click brings it back
- Marking something as not spam teaches it, so the next message from that sender arrives with that in its favour
- Anything it is unsure about is held for review rather than guessed at
The full picture of what gets collected and how the filter reasons is on the contact form submissions feature page.
The ten minute test for your own forms
Do this on your three busiest client sites. It is the fastest way to find out whether you have been losing enquiries without knowing.
- Submit the form from your phone on mobile data. Not office Wi-Fi. Mobile networks share addresses between a lot of people, which is exactly the pattern a crude filter punishes.
- Submit it from a privacy browser with tracking protection on. If the form silently does nothing, you have just reproduced what a privacy conscious customer experiences.
- Submit it with an ad blocker running. Same test, different common setup.
- Read the spam folder properly instead of emptying it. Not a skim. Actually read a week of it. This is where people find the enquiry they never answered.
- Check the form still delivers at all. Silent delivery failure looks identical to no enquiries, and we wrote about spotting that in how to tell when a contact form has quietly stopped.
What none of this fixes
Worth saying plainly.
No filter reaches zero spam without also blocking real people. Anyone promising that is either selling something or has not measured the second half. The goal is a sensible ratio with the errors pushed onto the cheap side, not perfection.
A filter also cannot make anybody read the review queue. If messages held for a human decision sit unread for a fortnight, you have rebuilt the original problem with extra steps.
And none of it helps if the form is not delivering. Spam filtering and broken delivery produce exactly the same symptom, which is an inbox with nothing in it.
Frequently asked questions
Layer the invisible checks instead. A honeypot field that only a script will fill, a minimum time between the page loading and the form submitting, proper server-side validation, and a reputation check on the sender will between them stop most automated spam without showing a visitor anything. Add a challenge only if spam is still getting through afterwards, and treat it as a last resort rather than a first line.
It can, and the failures are quiet. Privacy browsers, ad blockers and strict cookie settings can block the reCAPTCHA cookie, and when that happens the form simply does not submit and the visitor is given no useful explanation. Fast form fillers can also be scored as bots. Nobody reports these, because from the visitor's side it just looks like your website is broken.
For most WordPress sites, yes, as a first layer. A honeypot is a field hidden from people and visible to scripts, so a real visitor never knows it is there and never has to prove anything. It will not stop a targeted human spammer, which is why it works best combined with timing checks and a reputation signal rather than on its own.
Because a lot of modern form spam is not a crude bot. It is sent through real browsers, from residential connections, by services built specifically to pass these checks, and sometimes typed by a person being paid very little. A challenge that asks whether you are human is answered honestly by all of them.
Submit your own form from a phone on mobile data, from a privacy browser with tracking protection on, and with an ad blocker running. Then read the spam folder properly rather than emptying it. Most people discover the problem the other way round, when a customer mentions they filled in the form weeks ago and never heard back.
A per-site plugin can only judge what that one site sees, so a campaign hitting a hundred sites looks like one ordinary message to each of them. Collecting submissions centrally lets the same message be recognised across sites. WPCentrify gathers contact form submissions from every connected site into one list with a filter that explains each decision.
Related reading
Stop losing the enquiry you never saw
Collect contact form submissions from every WordPress site you manage into one list, with a spam filter that explains every decision and never deletes anything.
Free during early access. No credit card required.