The best contact form spam protection for websites
There is no single magic product. The best protection is the combination that stops the kind of spam you actually get, without costing you real enquiries or sending your visitors' data where it doesn't need to go.
The short answer
For most websites, the best contact form spam protection is invisible server-side checks (hidden trap field, time check, signed one-time token, rate limit, link rules) with a spam log, and optionally a one-second human action such as slide to send. Add a content filter only if paid human spammers remain a problem.
The options compared
| Option | Stops | Visitor effort | Watch out for |
|---|---|---|---|
| Image CAPTCHA | Simple bots | High | Loses enquiries; hard for many people; solvable by services |
| reCAPTCHA / hCaptcha / Turnstile | Most bots that load the page | Low to medium | Third-party scripts and data; only works if checked on the server |
| Honeypot field | Simple bots | None | Smarter bots skip hidden fields; use with other checks |
| Time check + one-time token | Fast bots and direct posters | None | Needs server code; set the time sensibly (about 4 seconds) |
| Content filter (e.g. Akismet) | Known spam text, some human spam | None | Sends messages to a third party; licence may be needed for business use |
| Rate limiting | Floods | None | Does not stop spread-out attacks alone |
What to look for
- Checks on the server. Protection that only runs in the browser can be skipped.
- No extra effort for real people, or at most one second.
- A log of what was blocked, so real enquiries can be found.
- Privacy: the fewer third parties see your visitors' data, the simpler your privacy policy and your compliance.
- Works with your form: WordPress plugin, custom code or both.
Our recommendation by type of website
- WordPress with a form plugin: turn on the plugin's honeypot and anti-spam token, add Turnstile if spam continues. See best spam protection for WordPress forms.
- Custom PHP or HTML website: add the server-side checks to your form handler, or have them installed for you.
- Business websites that depend on leads: invisible protection plus lead details and a spam log, so you never lose or misjudge a lead. See spam protection for businesses.
Common questions
Is reCAPTCHA the best spam protection?
It works well against bots that load your page, but it adds Google scripts to your site, sends visitor data to Google, and does nothing if the form handler doesn't check the result. Many sites get the same result with invisible checks alone.
Are free anti-spam plugins good enough?
Often, for WordPress, if you use their honeypot and token features and keep them updated. Custom websites have no plugin, which is where most unprotected forms are.
What is the best bot protection for contact forms?
A combination: signed one-time token, time check, hidden trap field and rate limit, checked on the server. It stops fast scripts, direct posters and most browser bots.