How to Stop Contact Form Spam in WordPress: 7 Proven Fixes (2026)

For years contact form spam was never a problem on QuickOnlineTips, until 2007, when the built-in Blix theme form started letting it through. A friend suggested a contact form plugin with a simple math challenge, and the spam stopped instantly. Spam bots are smarter in 2026, but stopping contact form spam in WordPress is still easy with the right layers.

Quick answer: Add Cloudflare Turnstile or Google reCAPTCHA v3 to your form, turn on your form plugin’s honeypot field, and connect Akismet to filter submissions. Block links in messages if you don’t need them, and use a form plugin that stores entries so you don’t miss real messages.

7 ways to stop contact form spam in WordPress

1. Cloudflare Turnstile

Cloudflare Turnstile (external site) is a free, mostly invisible CAPTCHA alternative. WPForms (external site), Contact Form 7 (external site), Fluent Forms (external site), Gravity Forms (external site) and others support it directly or through a small add-on.

2. reCAPTCHA v3 or hCaptcha

reCAPTCHA v3 (external site) scores visitors in the background, and hCaptcha (external site) is a privacy-focused alternative. Both work well but add Google or third-party scripts.

3. Honeypot field

A hidden field that humans don’t see but bots fill in. Most form plugins include one; make sure it’s turned on.

4. Akismet

Akismet (external site) filters form submissions as well as comments. Contact Form 7 and many form plugins integrate with it.

5. Block links and keywords

Reject messages with URLs or common spam words, if your visitors rarely need to send links.

6. Rate limiting and firewalls

Security plugins and Cloudflare (external site) can limit repeated submissions from the same IP or country.

7. Store entries and use proper email delivery

Save submissions in WordPress (Flamingo (external site) for Contact Form 7, or your plugin’s entries) and send mail through SMTP with a plugin such as WP Mail SMTP (external site) so real messages aren’t lost in spam filters.

What not to do

• Don’t publish your email address in plain text next to the form.
• Avoid hard CAPTCHAs that frustrate real visitors.
• Don’t rely on one method; combine two or three.

Fighting comment spam too? See the best WordPress plugins to stop comment spam and how to ban spammer IP addresses. Need a hosted form instead? Try these free contact form services. Cloudflare’s Turnstile page (external site) explains how it works.

FAQ

Why am I suddenly getting contact form spam?

Bots find forms through search and scanning. Once your form is listed, spam often spikes.

Is Turnstile better than reCAPTCHA?

Turnstile is free, privacy-friendly and rarely shows a challenge; reCAPTCHA v3 is also effective. Either works.

Will these fixes block real messages?

Rarely. Check stored entries or the spam folder in your form plugin from time to time.