Contact form spam on a business website: why the honeypot is not enough, and the three checks that stopped a bot posing as a customer

A honeypot, a form field hidden from people that simple bots fill in, stops scripts that post straight to a contact form, and does nothing against a bot that opens the real page in a real browser and fills it in slowly, like a person. On 9 October 2026 a sales pitch came through a tuning garage's quote form that already had a same-origin check, a per-IP rate limit, a honeypot and a three-second time trap. What stops that kind of message is a check on what was written, read the way the owner would read it: a UK phone number, no links in the fields, and known pitch phrases accepted silently so the bot believes it worked.

What the four usual layers catch

The same-origin check refuses a submission that did not come from a page on the site's own address, which stops scripts posting from somewhere else. The rate limit refuses an address that sends more than a few messages in a short time, which stops floods. The honeypot is a field hidden from people, so anything that fills it is a program reading the raw form rather than the page. The time trap refuses a form completed in under three seconds, which no person manages. Between them they stop the cheap end of form spam, the scripts that fire one message at as many sites as they can find, and they cost a real customer nothing, because a person never meets any of them.

The pitch that passed all four

The message on 9 October was a pitch for "lead response" software, with a foreign phone number and a link. Each layer had a reason to let it through. It was sent from the site's own page, so the origin check was satisfied. It was one message, so the rate limit had nothing to count. The hidden field was empty, because a bot that drives a browser fills in what the browser displays, and the honeypot is not displayed. And it took longer than three seconds. Every check that asks how a form was filled in had been answered, which left only the checks that read what was written.

The three checks that read the message

A UK phone check sounds like one line of code until you list how real customers write their number: a mobile starting 07 with or without spaces, the same number with +44 in front, a landline with the area code in brackets, and +44 (0)7 copied off a business card or an email signature. Our first version refused that last form. We fixed it, and the lesson holds for any check on any form: test it with the formats your customers use, not with your own number typed once. The check also has an honest limit. A holiday let or a shop that takes orders from abroad cannot demand a UK number, and on those sites a foreign number should be flagged for a person to read rather than refused.

Refusing links is the strongest single check, because the link is what a sales pitch is there to deliver, and a customer asking for a quote rarely needs to send one. The trap is the email address. It contains a dot and a domain name, so a careless link check refuses every customer who types their email into the message as well as into the email box. Take email addresses out of the text first, then look for web addresses.

The third check is the least obvious. Phrases that only ever appear in sales pitches are not refused with an error message; the sender gets the normal thank-you page and the message is not delivered as an enquiry. A bot told that it failed can come back with different wording. A bot told that it succeeded records a success and moves on to the next site.

Why we read the message rather than test the visitor

The usual advice is to add a puzzle, the box that asks a visitor to prove they are human. It has its place on a form under heavy attack, and it costs something on every form: one more step between a customer and the enquiry, on a phone, at the moment they decided to ask. We started with the message instead, because the message is what the owner cares about. A check that reads it the way the owner would read it costs a genuine customer nothing, provided it has been tested against the ways genuine customers write. That proviso is the whole risk. A refused customer does not ring to complain; they ring the next business on the map, and nobody ever finds out.

The test that proves the form still delivers

Every layer added to a form is one more way to lose a real enquiry without anyone knowing, so the last part of the fix is not a filter at all. On that garage's form a monitor sends a test submission through the real form every week, and it has to arrive. A form that refuses pitches and has quietly started refusing customers too looks exactly like one that works, from the outside, until the weekly test fails to land.

Checking your own form in ten minutes

1. Send an enquiry from your own phone with your mobile written as +44 (0)7 and the rest of the number, and check that it arrives.
2. Send another with your email address typed into the message box as well as the email field.
3. Send a third with a web address in the message, and decide whether your customers ever need to send one: a link to a listing, a photo album or a plan. If they do, the link rule needs an exception rather than a refusal.
4. Read the last month of spam that came through the form and note what it carried: foreign numbers, links, the same opening line. The pattern tells you which check would have stopped it.
5. Ask whoever looks after the site what happens when the form fails: who is told, how quickly, and how they would know.

The forms on the sites we build carry layers against spam, none of them aimed at people, and under hosting and care they are tested every week; the web design in Wales page sets out what else goes into every site. If your form lets pitches through, or you suspect it has been turning customers away, send us the address through the quote form and we will test it the way this guide describes.