You launch a new site, enquiries start arriving, and every single one is a pitch for SEO, loans or backpacks. This is common, and it is fixable. Here is why it happens and what actually works.
Why a simple honeypot is not enough
A honeypot is a hidden field that bots fill in and people do not. It stops lazy scripts, but many spam services now drive real browsers and fill forms like a person would, so they sail past it.
What the spam usually looks like
- Messages pitching SEO, link building, loans or products.
- Sender addresses on your own domain, or lookalike domains.
- Random names, repeated phone numbers and links in the message.
Layers that work together
- Human check: a privacy-friendly challenge such as Cloudflare Turnstile.
- Time and behaviour checks: reject forms completed implausibly fast and require evidence of a real browser session.
- Sender checks: block your own domain as a sender, check the email domain exists and remember repeat offenders.
- Content scoring: weigh cold-pitch phrases, links and mismatched contact details.
- Hold, do not delete: keep suspected spam in a review queue so a real enquiry is never lost.
Make real enquiries easier too
Fewer required fields, a clear promise of a reply time and a WhatsApp or booking option all raise the number of genuine enquiries while the filters keep spam out.
Do not rely on plugins alone
Stacking several anti-spam plugins slows your site and rarely beats a purpose-built filter that understands your own enquiries. I build this layered protection into the sites I deliver. If your form is flooded, send me a message and I will review it.
