Bot submissions on your form, and what they cost you.
Form spam costs you three things: the time to sort it, the trust your team loses in the enquiry channel, and, most expensively, the conversion data your bidding learns from. Stop it with layered defences that cost the visitor nothing: a hidden field bots fill and humans cannot see, a minimum time before submission, a modern challenge such as Turnstile that most people never see, and server side rate limiting. Avoid anything that makes a real customer prove themselves, because the cost of a lost genuine enquiry is far higher than the cost of deleting junk.
The expensive part is not the deleting
If a junk submission fires your conversion tag, you have told the advertising platform that this was a success. Automated bidding then goes looking for more of whatever produced it.
So spam does not only waste time. It quietly steers your budget, which is a version of the same problem as optimising towards the wrong event, arriving through a different door.
There is a second cost that is harder to see. Once the inbox is full of junk, real enquiries wait longer, because nobody checks a channel they have stopped trusting.
Layers, not a wall
No single measure stops everything, and the ones that stop everything also stop customers. The approach that works is several cheap layers, each invisible to a person.
- A honeypot field, hidden from people and attractive to automated scripts. Anything that fills it is discarded.
- A minimum time between the page loading and the form being submitted. People take longer than scripts do.
- A modern challenge such as Cloudflare Turnstile, which most visitors never interact with at all, unlike the image puzzles everybody remembers.
- Rate limiting on the server, so one source cannot submit repeatedly however the request is made.
- Validation on the server as well as in the browser, because a script does not use your browser at all.
Do not make customers prove themselves
The instinct after a bad week of spam is to add friction. It is the wrong instinct, because the arithmetic is lopsided: deleting fifty junk messages costs a few minutes, and losing one genuine enquiry can cost a customer.
Image puzzles are the clearest example. They frustrate people, they are worse on a phone, and they are a real accessibility barrier. Newer challenges do the same job while staying invisible to almost everybody.
Stop counting junk as a conversion
Whatever protection you add, the conversion definition should also be tightened, so the number the platform optimises towards means something.
If you can only mark spam after the fact, do that and exclude it, or use offline conversion uploads so only real enquiries are fed back. This is the same discipline as checking that tracking counts what you think it counts, and it is the part most often skipped.
Watch for the pattern, not the individual message
A sudden rise in submissions with no rise in traffic is the clearest signal. So is a batch arriving in the small hours, all with the same shape of message, or names and email addresses that follow a visible pattern.
Those patterns tell you which layer is missing. Identical timing points at a script; varied timing with identical content points at something more deliberate, which is worth blocking at the network level rather than in the form.
How many of last month's enquiries were real
Count them. If more than a small share were junk, your conversion data is being shaped by it, and the advertising has been learning from that shape for however long it has been happening.
If you would like the form hardened without making it harder to use, tell us what you are running through the enquiry form. It is usually an afternoon of work, and it is one of the few fixes that improves both the inbox and the advertising at the same time.
Questions we get asked.
How do I stop spam form submissions?
- Use layers that cost the visitor nothing: a hidden honeypot field, a minimum time before submission, an invisible challenge such as Turnstile, server side rate limiting, and validation on the server rather than only in the browser.
Why is form spam more than an annoyance?
- Because junk submissions usually fire your conversion tag, which tells the advertising platform they were successes. Bidding then looks for more of whatever produced them, so your budget is quietly steered by the spam.
Should I use an image puzzle to stop bots?
- Prefer a modern invisible challenge. Image puzzles frustrate real customers, are worse on a phone and create an accessibility barrier, and losing one genuine enquiry costs far more than deleting a week of junk.
Does adding more form fields reduce spam?
- Barely, and it reliably reduces genuine submissions. Scripts fill fields cheaply. People give up. Solve it with invisible checks rather than by asking customers for more.
How do I keep spam out of my conversion data?
- Tighten what counts as a conversion, and where you can only identify junk afterwards, exclude it or feed back only verified enquiries as offline conversions. Otherwise the platform keeps optimising towards submissions nobody wanted.
