How to stop Webflow form spam
What Webflow's built-in form protection does, what it can't catch, free ways to cut the junk, and how to sort the sales pitches that still arrive.
Updated
Webflow forms are quick to build, and bots find them just as quickly. Publish a site with a contact form and the junk starts arriving: gibberish, scam offers, link drops, and polite strangers who'd like to redo your SEO.
Webflow gives you some protection, and a few free tricks get you further. Here's what each one does, what it misses, and what to do about the sales pitches that arrive anyway.
What Webflow's built-in protection does
The main built-in protection you control is reCAPTCHA. You get a pair of keys from Google, add them in your site's form settings, and then add a reCAPTCHA element to each form you want covered. Webflow's settings move around from time to time, so if you can't find it, search Webflow's help for reCAPTCHA.
Once it's on, a visitor has to pass Google's check before the form will submit. That stops simple bots, and it's worth turning on if you haven't.
The cost is friction. Visitors see a reCAPTCHA box on the form, and some get a picture puzzle on top of it. Every hoop is a chance for a real customer to give up and try the next business on the list.
What it can't catch
reCAPTCHA asks one question: is this a person? Three kinds of message get past that question.
- More bots than people. Automated traffic was 51% of all web traffic in 2024, the first time in a decade it passed human traffic.
- AI form-fillers. SentinelOne documented AkiraBot, which uses OpenAI to write unique spam for contact forms on Shopify, GoDaddy, Wix and Squarespace sites while bypassing CAPTCHAs. Every message is worded differently, so there's no repeated phrase to block.
- People. A salesperson typing a pitch into your form passes every bot check, because they're a person. reCAPTCHA did its job. It was asked the wrong question.
Then there's the question no filter can answer for you: is this message even unwanted? "Can you help us rank higher on Google?" is a lead for an SEO agency and a pitch to a plumber. The words are identical. Only your business decides which one it is.
Free ways to cut the junk
A honeypot field
A honeypot is a field hidden from people but visible to bots. Real visitors leave it empty; simple bots fill in everything. Webflow doesn't offer one as a setting, so it takes custom code: a hidden field, plus a short script that stops the form from submitting if that field has anything in it. Adding custom code may need a paid site plan.
The tradeoff: the check runs in the visitor's browser, so a bot that sends its submission straight to Webflow without running your script skips it. It's still worth having, because it costs real visitors nothing.
A vendor address and a polite note
A line under the form, "Selling something? Email vendors@yourdomain.com", gives salespeople somewhere else to go. "No sales or SEO pitches, please" is free too. Both are weak. Some people respect them, and bots don't read them.
Sorting the pitches that still arrive
A "What's this about?" dropdown
Add a required dropdown with options like "New project", "Existing client" and "Selling a product or service". Webflow includes the answer in the notification email, so an inbox rule can file the sellers. Some will pick "New project" anyway. It sorts; it doesn't block.
Inbox filters
Gmail and Outlook can move form emails containing phrases like "guest post", "backlinks" or "SEO audit" into a separate folder. Nothing is lost, because you can skim the folder. The catch is upkeep: pitches get reworded constantly, and every phrase you add will eventually catch a real customer.
Whatever you set up, filter into a folder you actually check, never straight to the trash. A pitch in your inbox costs a few seconds. A customer in the trash costs the job.
Where Ascue fits
Ascue works with Webflow forms through email forwarding, with no code. You set the address that receives your form's notification emails to your site's private Ascue address, and Ascue forwards everything except what it holds back. The Webflow setup steps walk through it.
Every message gets one of four labels. Lead is delivered right away. Pitch is held for a weekly digest or delivered tagged, your choice. Spam is blocked and kept for 30 days. Ask me is delivered marked "Ascue wasn't sure", and one click confirms or corrects it. Ascue reads a one-sentence description of your business with each message, so "help us rank higher" is judged by what you sell.
Visitors never see a CAPTCHA, because the sorting happens after they hit submit. When in doubt, it delivers, and nothing is deleted. If Ascue is down or slow, messages are delivered unsorted rather than held. It's free for your first 50 messages a month.