formexposed
Get started
Free check · no sign-up

Is your contact form exposed to spam bots?

formexposed finds your contact forms and checks their visible spam protection – from the outside, in about a minute. Nothing is submitted.

  • Free
  • no sign-up
  • read-only
  • about one minute

The free check examines publicly detectable features. Undetected protection does not prove that protection is absent; email and CRM delivery are not tested.

By starting the check you agree to our Terms of Service; how we process data is explained in our Privacy Policy.

See pricing →

Works with any website: WordPress, Shopify, Webflow, custom PHP

WordPress TYPO3 Shopify Webflow Wix Custom code

What gets checked

The protections a form should have — and whether yours has them

Every finding comes with evidence, a severity and a fix guide for the CMS you use.

CAPTCHA detection

reCAPTCHA v2/v3, hCaptcha, Turnstile and Friendly Captcha — present, loaded and actually enforced, not just embedded.

Honeypots and tokens

Hidden fields, timestamps, nonces and CSRF tokens: the quiet defences that stop most bots without bothering people.

Rate limits

Whether the same form can be submitted again and again from one address without being slowed down or blocked.

CMS fingerprint

Known unprotected set-ups such as Contact Form 7 without Akismet or reCAPTCHA are recognised and named.

Monitoring

A plugin update can switch protection off without anyone noticing. We re-check on a schedule and alert you when it happens.

Fix guides

Step-by-step instructions for WordPress, TYPO3, Shopify, Webflow and custom code — included in every report, free or paid.

How it works

Three steps, nothing to install

1

Enter a domain

We fetch a few public pages and locate the contact form, respecting robots.txt.

2

Get the report

Within a minute you see what protects the form, what does not, and how serious it is.

3

Verify and monitor

Prove the domain is yours to unlock the full test suite and scheduled re-checks with alerts.

"A contact form that sends e-mail without protection is an open relay with a nicer front end."
Why formexposed exists

From the blog

All articles →
Product

How agencies keep dozens of client forms working

For many clients the contact form is the page that brings in money – yet after launch nobody owns it. A routine, contrac…

05.10.2026 Product

How a formexposed check works: passive, transparent, respectful

What happens between entering a domain and reading the report – what the scanner loads, what it checks, what it never do…

01.10.2026 Basics

WordPress contact forms: a security checklist

Contact Form 7, WPForms, Gravity Forms, Ninja Forms or Fluent Forms – the plugin matters less than how it is set up and …

28.09.2026

Check your form before someone else does

The first check is free and takes about a minute. No account, no installation.

Check a domain