WordPress spam emails, the three kinds and how to fix each one
Spam emails from a WordPress site usually mean one of three problems, each with a different fix. Here is how to tell them apart in a minute and fix yours, from the team behind WPCentrify, a WordPress website management platform.
The short answer
WordPress spam emails are one of three problems: junk form submissions filling your inbox, real form notifications landing in your spam folder, or a hacked site sending spam itself. Block the first with spam protection on your forms, fix the second by sending mail through SMTP with SPF and DKIM, and fix the third by cleaning the site.
Disclosure: WPCentrify is our product. Facts about other tools come from their own pages, checked 30 October 2026.
Which kind of WordPress spam emails are you getting?
Match what you see to the table, then jump to the fix.
| What you see | What is going on | The fix |
|---|---|---|
| Junk messages from your contact form fill your inbox | Bots or people are submitting your form | Add spam protection to the form |
| Visitors say they wrote to you, but you never saw it | Your form emails land in spam or are never sent | Send through SMTP with SPF and DKIM |
| Bounces for email you never sent, or your host blocks your mail | Your site may be hacked and sending spam | Clean the site and close the hole |
Start with the row that matches what you see. Many sites have two of these at once.
How do you stop spam submissions in WordPress?
Bots find contact forms automatically and send the same pitch to thousands of sites. Good WordPress spam protection stops them without annoying real visitors, so use a few light layers:
- A honeypot. A hidden field people never see but bots fill in. Most form plugins have one built in.
- A quiet bot check. Cloudflare Turnstile is free for up to 20 widgets and usually works without a puzzle.
- A few rules. Block words, countries or email domains you never hear from, and messages sent faster than a person could type.
- Keep, don't delete. Send suspected spam to a folder you check once a week. A filter that throws away one real lead costs more than a week of spam, which we explain in how to stop WordPress contact form spam without losing leads.
Which WordPress anti spam plugin should you use?
Comment spam and form spam need different tools:
| Tool | What it protects | Price |
|---|---|---|
| Akismet | Comments, and forms in plugins that connect to it | Pay what you can for personal sites; Pro is $9.95 a month, billed yearly, for business sites |
| Antispam Bee | Comments and trackbacks only, not forms | Free, for personal and commercial sites |
| Cloudflare Turnstile | Any form you add it to, usually without a puzzle | Free for up to 20 widgets |
Prices from each vendor's own page, checked 30 October 2026.
Free WordPress forms are fine for most small sites: most form plugins have a free version with a honeypot or CAPTCHA option, as long as you turn it on. For the exact settings in Contact Form 7 and Elementor, see how to prevent spam contact form submissions in WordPress.
Why are WordPress form emails going to spam, or not sending at all?
This is the opposite problem: real messages exist, but you never see them. By default WordPress sends mail through your server's PHP mail function, which does not prove the email really comes from your domain. Since February 2024, Gmail asks every sender to set up SPF or DKIM, so unauthenticated form emails get filtered or rejected.
The From address is the other usual cause. Many forms send the notification "from" the visitor's own Gmail address, which your server cannot prove, so it looks forged.
How to fix a WordPress form not sending email
- Send a test entry. Fill in your own form and check both the inbox and the spam folder of the address that should receive it.
- Fix the From address. Set the From address to an address on your own domain, such as forms@yourdomain.com, and put the visitor's email in the Reply-To field.
- Send through SMTP. Install an SMTP plugin and connect it to a real mail service, such as your email provider or a transactional email service.
- Add SPF and DKIM. Add the SPF and DKIM records your mail service gives you to your domain's DNS, and add a DMARC record when you are ready.
- Test again. Send another test entry and confirm it lands in the inbox, not in spam.
If nothing arrives anywhere, the form itself may be broken. Our guide to spotting a broken WordPress contact form covers the seven quiet ways forms fail.
What if your WordPress site is sending spam?
Bounces for email you never sent, your host suspending outgoing mail or your domain on a blocklist usually mean malware or a hijacked account is sending spam from your server.
Ask your host to pause outgoing mail, then scan your WordPress site for malware, remove admin users you do not recognize, change every password and update every plugin and theme. Our hacked WordPress site guide walks through it in order.
How to keep form spam under control across many WordPress sites
One site's form spam is a nuisance. Twenty clients' form spam is a part-time job, and real inquiries get lost. If you manage multiple WordPress sites, WPCentrify, our WordPress website management platform, collects contact form submissions from every site into one list:
- Works with the forms you have: WPForms, Gravity Forms, Contact Form 7, Elementor Forms, Fluent Forms, Ninja Forms, Formidable, Forminator and Jetpack Forms.
- Its own spam rules: no third-party spam service or AI model sees your submissions.
- Reasons in plain sentences: for example, the same message has reached many other sites recently.
- Nothing deleted: press Not spam and the inquiry is back in your list.
- A quiet site stands out: often the first sign a form stopped sending.
It is available now on the Studio plan and up, or as an add-on on Solo. Plan prices are to be revealed.
Sources
- Email sender guidelines, Google
- Pricing, Akismet
- Antispam Bee, WordPress.org
- Turnstile plans, Cloudflare
All sources checked on 30 October 2026.
Questions about WordPress spam emails
Usually because bots have found your contact form. Every submission is emailed to you, so form spam arrives as email. A honeypot field plus a check such as Cloudflare Turnstile stops most of it.
Most often because WordPress sends them through the server's PHP mail function without SPF or DKIM, or because the From address uses the visitor's own email. Send through an SMTP service with SPF and DKIM set up, and use an address on your own domain as the From address.
Only for comments. WordPress can hold comments for moderation and block words or links you list, but it has no spam protection for contact forms. That comes from your form plugin or an anti spam plugin.
For comments, Antispam Bee is free for personal and commercial sites. For forms, use the honeypot built into your form plugin plus Cloudflare Turnstile, which is free for up to 20 widgets. Akismet is pay what you can for personal sites, and business sites need a paid plan.
No. It stops most bots, but people paid to fill in forms get through, and hard puzzles turn away real customers. Use it as one layer next to a honeypot and filtering rules.
Related reading
Stop contact form spam without losing leads
Why an over-eager spam filter costs more than spam, and the ten minute test for your own forms.
Read the guideSpot a broken contact form early
Seven ways a WordPress contact form fails silently, and how to check yours today.
Read the guideEvery inquiry in one list
Contact form submissions from every WordPress site you manage, with a spam filter that keeps what it sets aside.
See the featureMore on this topic: how to scan a WordPress site for malware and what to do when a WordPress site is hacked.
See every inquiry from every site in one list
WPCentrify collects contact form submissions from every WordPress site you manage, sets the spam aside with a reason and deletes nothing.
Plan prices to be revealed. Start free on one website today.