“My form gets 50 spam messages a week.” The spam is a nuisance; the real cost is the homeowner’s message buried in the middle of it, or the homeowner a too-strict filter turned away and you never knew existed. The aim is not zero spam. It is every real lead arriving, with as little junk around it as you can manage.
What you are up against
OWASP, a community-led software security project, catalogs this as automated threat OAT-017, Spamming: “Malicious or questionable information addition to public or private content, or messages,” with “form spam” among its other names. Some of what reaches a contractor’s form is software that finds forms and fills in every field. Some is typed by people, and no bot check stops a person: OWASP notes that visible CAPTCHAs are “outsourced to human solver farms for fractions of a cent per solve.”
One problem is not spam at all. OWASP leaves “the mass abuse of broken form-to-email and form-to-SMS functions, to send messages to unintended recipients” out of the spam category because it is an implementation flaw. If your form can be made to send email to an address the visitor chooses, that is a bug for whoever built the site to fix, not something a filter should be hiding.
Start with checks the homeowner never sees
OWASP’s advice is to layer: “A single control is brittle.” For a contractor’s form, three layers can run without the homeowner seeing any of them.
1. A honeypot field
Add a field that people cannot see and software fills in. OWASP calls honeypots “cheap, effective, and zero impact on legitimate users.” “Bots fill it; humans do not. Reject the submission.” The details matter, because a careless honeypot catches real people. OWASP’s example moves the field off screen, hides it from screen readers, takes it out of the tab order and turns off autocomplete. That last one matters: if a browser’s autofill fills the hidden box for a real homeowner, her message is thrown away, which is why the autofill test below matters.
2. A minimum fill time
Record when the page loaded and compare it with when the form came back. A person typing a name, a phone number and a sentence about a leaking roof takes a while; software posting straight to your form can take no time at all. Keep the threshold short, a few seconds, because autofill makes real people fast too, and treat a too-fast submission as suspicious rather than proof.
3. A rate limit
OWASP calls rate limiting “the foundational control” and says to apply it at more than one level, not just by IP address. On a contact form, a cap on submissions from one address or session in an hour costs a homeowner nothing and stops a script that sends hundreds.
A fourth layer is a content filter: links in the message box, the same text arriving again and again, words that only spam uses. The W3C’s note on CAPTCHA and accessibility says properly tuned spam filters “can achieve results comparable to a traditional visual CAPTCHA, while also removing the added cognitive burden on the user and eliminating access barriers.” The note adds that most major blogging software has spam filtering built in or available as a plug-in, and that many filters can delete messages past a spam threshold and mark questionable ones for a person to review.
When you need more: invisible challenges
If spam still gets through, add a challenge that usually asks nothing of the visitor.
Either one only works if your server checks the result. Cloudflare is blunt about it: “The client-side widget alone does not protect your forms.” Its tokens can be forged if you never verify them, last 300 seconds and work once. Whoever installs it should confirm the form’s back end calls the verification step, and should test what happens when a homeowner takes longer than five minutes to finish typing.
Visible puzzles last, if at all
The picture grids and wavy letters are the one layer that asks real work of every homeowner. OWASP calls visible CAPTCHAs “accessibility-hostile, machine-solvable by ML, and outsourced to human solver farms.” The W3C note says interactive tests inherently exclude many people with disabilities, “resulting in a denial of service to these users.” Your customers include older homeowners and people filling in a form on a phone in a driveway. If you must use one, OWASP says to provide an accessible alternative, such as audio or another way to reach you.
Hold suspicious messages; do not delete them
OWASP’s response advice is “Don’t Always Block”: a graduated response, with suspicious traffic logged and flagged rather than refused. For a contractor that means three outcomes, not two:
The weekly look is quick, and it is how you find out a filter is catching people. One real roof leak in the held folder is worth the other 49 messages.
Test that homeowners still get through
After any change, send yourself real submissions the way customers do:
Then watch the count. Note how many real form leads you got in the month before the change and the month after. If spam fell and real leads fell with it, the filter is too strict, whatever the spam folder says. Your Answer Rate shows how to log every call and form for a week, and The Website Pages a Contractor Needs covers where the form belongs on the site.