Contact form spam

By combining several simple barriers: an invisible captcha (like Cloudflare Turnstile or Google's reCAPTCHA), a hidden trap field that only bots fill in, called a honeypot, and a limit on how many submissions one person can make in a short time. With that, most of the spam disappears without bothering the people who genuinely write to you, who, after all, are the ones you care about.

Spam arrives because there are bots sweeping the internet filling in forms with ads or links, and sometimes checking whether your form can be used to send emails to other people. What's misleading is thinking the cure is the traffic-lights captcha: it works, but it scares off customers; today there are options nobody notices. Also watch out for forms that send an automatic copy to whoever fills them in: they can be used to send spam to third parties in your name. And if the website was made by an AI, the form usually comes unprotected: ask for protection explicitly.

Spam was one of the blows I took when I published my website, and I tell the story in "Where the attacks came from when I published my website". A practical tip in the meantime: don't open the links that arrive in those messages, however friendly they look. Form spam isn't always just annoying: sometimes it's the way in for a scam, and one distracted click is enough for the problem to stop being your inbox.