5 Simple Ways To Block WordPress Contact Form Spam

Tired of sorting through spam messages from your WordPress contact forms? You're not alone. Spam quickly clutters an inbox and wastes precious time.

Approximate read time: 4 minutes

The good news is there are a few genuinely effective ways to stop it, without making real visitors jump through hoops. In this post, we'll walk through 5 of the best anti-spam methods for WordPress contact forms, and why each one works.

1. Block spam with the honeypot method

The honeypot method is a pretty sweet type of contact form spam protection. Get it?

Here's how the honeypot spam blocker works:

• It creates a hidden field on your contact form page that's invisible to visitors but seen by bots.
• Since the bot sees the honeypot field, it fills it out.
• When the bot tries to submit its contact form spam message, the submission is blocked because there's a field filled out that shouldn't be.

Gotcha.

The best contact form plugins, including Formidable Forms, let you turn this on with a single click, so there's no reason to skip it. It's also invisible to real visitors, so it rarely costs you a legitimate submission.

2. Add a JavaScript token

Most spambots don't run JavaScript the way a real browser does, so this method flips that into a defense. An autogenerated JavaScript token gets created only when an actual browser loads your site, then it's quietly inserted into your form without visitors ever noticing it's there.

When someone submits the form, your site checks for that token first. No token means no real browser was involved, so the entry gets rejected before it ever reaches your inbox.

With Formidable Forms, you can turn this on in one click; no need to touch any code yourself. It's a good first layer because, unlike a honeypot, it doesn't depend on a bot making a mistake. It just checks for a signal that's hard for most bots to fake at all.

3. Add invisible reCAPTCHA

Google's reCAPTCHA checks whether a visitor is human, and the invisible version does it without interrupting anyone. Invisible reCAPTCHA tracks mouse movement in the background, so real visitors click through normally while bots get blocked before they can submit. No picking out traffic lights or typing in squiggly text.

Invisible reCAPTCHA is available with one click in a WordPress contact form builder like Formidable Forms. Looking for a free alternative to Google reCAPTCHA? Check out Cloudflare Turnstile; you can add it to Formidable Forms too.

4. Use reCAPTCHA v3

reCAPTCHA v3 takes the invisible approach a step further. Instead of a pass/fail check, it scores every submission from 0.0 to 1.0 based on how human the behavior looks, and you decide where to draw the line.

Over time, reCAPTCHA v3 learns more about your site by watching real traffic, so you can adjust the score threshold to block more or less strictly without changing anything else about your form. It's a great way to catch more sophisticated spammers, including real people submitting junk by hand, not just bots.

👉 Learn how to add reCAPTCHA to WordPress contact forms.

5. Let Formidable Forms manage spam entries automatically

No spam method is perfect, and any of the ones above can flag a visitor by mistake. Formidable Forms can save suspected spam as spam entries, with the reason each one was flagged, so you can review them and mark each one as spam or not spam. You don’t need a separate anti-spam plugin just to see what got blocked. Think of it as a safety net under everything else on this list.

Spam entries stay out of your regular entries list, so they won’t throw off your counts or trigger notification emails before you’ve reviewed them.

With a paid license, you can also set spam entries to delete automatically after a retention period you choose, so you’re not stuck clearing out junk by hand every week.

Ready to stop contact form spam on WordPress?

Stack a JavaScript token or honeypot with invisible reCAPTCHA or reCAPTCHA v3, and you'll stop nearly every spambot without adding friction for real visitors. Then add Formidable Forms’ spam entries as a safety net, so if a method ever flags a customer by mistake, you can catch it and rescue their message.