Why contact forms get spammed – and why it's more than an annoyance

Almost every website with a contact form knows the pattern: a few days after launch, the first messages arrive that nobody really wrote. Offers for SEO services, links to dubious shops, text in languages the site has never used. Most people just delete them – which underestimates the problem. Form spam is not just noise in an inbox – it can turn your own website into a tool that works against you.

Who sends form spam

• Crawling bots. Automated programs scan the web for anything that looks like a form – an input field, a text area, a submit button – and fill it in. They find you simply because your form exists.
• Cheap scripts and ready-made tools. Software for mass form submission is easy to get. One person can send thousands of messages a day without writing a single line of code.
• SEO link spam. Many messages exist only to place a link somewhere – in your inbox, in a comment area or on a page that publishes submissions. The hope is that the link gets indexed somewhere or that someone clicks it.
• Phishing and malware. Some messages imitate invoices, complaints, copyright notices or “there is a problem with your website” alerts, with a link to a fake login page or a file. Because they arrive through your own form, they often look more trustworthy than ordinary e-mail.

When your form sends the spam

Many forms send an automatic confirmation to the address the visitor entered: “Thank you for your message, here is a copy of what you wrote.” For a real visitor that is friendly. For a spammer it is an opportunity. The bot enters someone else's address in the e-mail field and puts its advertising or phishing link in the message. Your server then dutifully sends that text – under your domain name – to a stranger who never visited your site.

Mail providers judge incoming mail partly by the reputation of the sending domain and server. Spam complaints, hits on spam traps and sudden spikes in volume all count against you. The awkward part: SPF, DKIM and DMARC do not help here. These mechanisms confirm that a message really comes from your domain – and in this case it does. Authentication proves the origin, not that the content is wanted. Once the reputation drops, your normal business mail is affected too: quotes, invoices and replies to customers start landing in spam folders, and recovery can take a long time.

A related mistake does damage even without any spam. Some form setups send the notification with the visitor's address as the sender (“From”). Your server is not authorised to send mail for that visitor's domain, so SPF and DKIM do not align with the From address. If that domain publishes a strict DMARC policy, the message is rejected or filed as spam – real enquiries included. The cleaner pattern: send from an address on your own domain and put the visitor's address in Reply-To.

And the everyday damage

• Wasted time. Someone has to read, sort and delete. A few minutes a day add up to whole working days over a year.
• Real enquiries get lost. When the inbox is mostly junk, people skim – or set aggressive filters. The one genuine request for a quote gets deleted with the rest, or answered a week too late.
• Phishing reaches your team. A link that arrives through your own contact form gets clicked more easily than one in a random e-mail. A single password entered on a fake login page can cost more than all the spam combined.
• Polluted data. If submissions flow into a CRM, a newsletter list or a ticket system, fake entries distort the data and may trigger further automated mails.

What “protected” means in practice

There is no single switch. A form is well protected when several layers each catch part of the problem, so that one failing layer does not open the door completely.

You can see where your own forms stand without touching them. A free check on formexposed.com visits your public pages passively – nothing is submitted – and shows for each form whether a CAPTCHA, honeypot, CSRF token and time trap are present and look effectively configured. The scanner also runs GDPR and accessibility checks; their details are part of the full report. The result is one of three levels: protected, partially protected or exposed. That is a good starting point for deciding which layer is missing.