What to do when a bot floods your contact form

You wake up to two hundred form notifications. Or your phone has buzzed every thirty seconds since lunch. It's almost always one script that found your form and is working through a list, and it's rarely personal. It will stop. The aim is to make sure it stops costing you anything before then.

Here's what to do in the first ten minutes, then how to slow the bot down, then how to be ready for the next one.

First: stop the damage

1. Turn off any email your form sends to the visitor. Autoresponders and "send me a copy" options mail whatever address the bot typed in, from your website. During an attack that can be hundreds of emails to strangers, which can get your domain's own mail treated as spam. Turn them back on once things are quiet.
2. Give the notifications their own folder. A mail rule that matches the form's subject line and moves it out of your inbox stops your phone buzzing, without deleting anything.
3. Don't delete the pile yet. A real customer may have written in the middle of it. Search the folder for names, phone numbers or your town before clearing it out.

Then: slow the bot down

Start with whatever your visitors won't notice, and only reach for a puzzle if nothing else works.

Turn on your form's own honeypot or anti-spam setting

Most form plugins have a hidden field that simple bots fill in, or a built-in protection that runs in the background. If yours was off, this alone may end the attack. Where to find it in each form plugin.

If you're behind Cloudflare, use it

Bot Fight Mode is on Cloudflare's free plan: a single switch that challenges traffic that looks like known bots. It can't be fine-tuned, so afterwards check that anything you rely on, such as a booking or payment webhook, still works. Cloudflare also has rate limiting rules that cap how often one address can post to a page; what your plan includes varies.

Add an invisible check, or a CAPTCHA for now

If the bot is still getting through, a check visitors don't interact with, such as Cloudflare Turnstile in its non-interactive mode, is the next step. During a heavy attack, a visible CAPTCHA for a day or two is a reasonable trade. Make a note to take it off again; a puzzle that stays forever costs you customers long after the bot has moved on.

Blocking IP addresses rarely helps

It's tempting to block the addresses in the notifications. Attacks usually come from many addresses, and a bot that's blocked moves to the next one. Block a few if one address is doing most of the sending, but don't spend your afternoon on it.

Why it happened

Bots find forms by crawling the web, the same way search engines do. A form that has been quiet for years can be picked up by a new list overnight. Some bots post links, some probe for forms that will send email for them, and some are just broken scripts stuck in a loop. None of that means your site has been hacked: a form receiving junk is the form working as designed.

Next time: have something watching the door

Every fix above is something you do after you notice. The better setup is one that notices for you: quiet protection that's always on, and something that tightens up by itself when a burst starts and relaxes when it ends.

That's what Ascue's attack protection does. When a form gets a burst of spam, Ascue switches on attack protection: it blocks the bot's addresses and copies of what it sends, keeps letting real customers through, emails you once, and switches off after 30 quiet minutes. Blocked messages wait in your dashboard for 30 days and don't use your monthly checks. With the WordPress plugin, an invisible browser check also stops scripts that post forms without a browser, so many bots never get that far.

The rest of the time, Ascue sorts every message into a real lead, a sales pitch or spam, without a CAPTCHA. It's free for your first 50 messages a month.