How to stop thousands of spam form submissions
When a form is under attack, hundreds of messages can arrive in an hour, fill your inbox and put your email sending at risk. Stop the flood first, then fix the form properly.
The short answer
To stop a spam flood right now: temporarily take the form offline or require a slide-to-send step, turn off any copy sent to "the sender", and block the form handler from being called directly. Then add invisible server-side checks (trap field, time check, one-time token, rate limit) and a spam log before putting the form back.
Step 1: stop the flood in the next 15 minutes
- Take the form offline for now. Replace it with your email address or WhatsApp number while you fix it. Losing a day of form messages is better than losing your email reputation.
- Turn off "send a copy to the sender". If attackers are putting other people's addresses in the email field, your website is sending their spam. This is the most urgent thing to stop.
- Tell your hosting company. They can block the attacking addresses at the server and confirm whether your website sent unusual volumes of email.
- Don't delete everything yet. Keep a sample of the spam: it shows how the attack works.
Step 2: find out how they get in
Look at your server's access log for the file that receives the form. If the requests go straight to that file without your page being loaded first, the bots are posting directly, and anything shown on the page (including a CAPTCHA) cannot stop them. If they load the page, the form's own checks are too weak.
Also check whether all the messages come from a few IP addresses (a rate limit stops them) or thousands (you need checks on how the form is filled in, not on who sends it).
Step 3: fix the form so it stays fixed
- Add a one-time token signed by the server, so the form handler rejects anything not started on your page.
- Add a hidden trap field and a time check.
- Add a rate limit per visitor, and a daily cap on confirmation emails per address.
- Answer blocked attempts with a normal "thank you" so the attacker learns nothing.
- Keep a spam log so you can see the attack stop, and check any real message caught by mistake.
These are the same methods described in how to stop contact form spam, applied strictly.
Step 4: check your email reputation
If your website sent spam to other people, your domain may be listed on email blocklists. Check your domain with a blocklist lookup tool, and make sure SPF, DKIM and DMARC are set up for the address your website sends from. If you are listed, most blocklists have a removal request once the cause is fixed.
Common questions
Will a CAPTCHA stop a spam attack?
Only if the attack goes through your page. Many attacks post straight to the form handler, which a CAPTCHA on the page cannot stop. A server-side token check can.
Should I block the IP addresses?
It helps if the attack comes from a few addresses. Large attacks rotate through thousands of addresses, so checks on how the form is filled in work better.
Can you fix it for me today?
Yes. Send us your website address; spam attacks get priority, and we tell you what we find before any work starts.