Skip to content

How to stop WPForms spam

Why WPForms spam gets past CAPTCHAs, the free settings worth turning on first, and what to do about the sales pitches no anti-spam setting catches.

Updated

WPForms makes a good contact form. Like any contact form, it attracts bots, and because it emails you every submission, it passes the junk straight along.

The junk comes in two kinds: ordinary spam (gibberish, scams, link drops) and sales pitches (SEO audits, redesign offers, "I'd love to write a guest post for your blog"). The first is a bot problem. The second mostly isn't, and that decides which fixes work.

Why WPForms spam gets past CAPTCHAs

A CAPTCHA asks one question: is this a person? That's no longer enough.

  • There are more bots than people. Automated traffic was 51% of all web traffic in 2024, the first time in a decade it passed human traffic.
  • AI writes the messages now. SentinelOne documented AkiraBot, which uses OpenAI to write unique spam for contact forms on Shopify, GoDaddy, Wix and Squarespace sites while bypassing CAPTCHAs. When every message is worded differently, there's no repeated phrase to block.
  • Some of it is typed by people. A salesperson filling in your form by hand passes every bot check, because they aren't a bot. The CAPTCHA did its job. It was asked the wrong question.

So use WPForms' settings to stop simple bots cheaply, without making customers jump through hoops. The pitches need a different approach.

The free settings worth turning on first

WPForms moves settings around between versions, so if a name below doesn't match your screen, look in the form's spam protection settings.

WPForms' own anti-spam protection

WPForms has built-in spam protection that works in the background, with nothing for visitors to click. It's usually on for new forms, but check each one, especially older forms. It costs your visitors nothing, so confirm it first.

A CAPTCHA, if bots still get through

WPForms integrates with reCAPTCHA, hCaptcha and Cloudflare Turnstile. If you add one, pick a version that usually runs without a puzzle, such as Turnstile or reCAPTCHA v3. Every challenge is a chance for a real customer to give up and call someone else.

Akismet

If you already run Akismet, WPForms can pass form submissions through it too. Akismet is good at known spam sources and repeated junk. It's free for personal sites; business sites are expected to pay.

Keyword, email and country filters

Depending on your license and version, WPForms may offer options to block submissions by keyword, email address or country. Use them sparingly. A keyword list catches the real customer who happens to use the word, and a country block shuts out the customer who's traveling.

The messages no setting catches

With the bots handled, what's left is polite, well-written, obviously human messages that want to sell you something. "I noticed your site isn't ranking for key terms." "We build apps for half the cost." "Can I contribute an article to your blog?"

These get through because nothing is technically wrong with them. A person, or an AI writing like one, filled in the form from a real email address. Every setting above worked as designed. It just wasn't designed for this.

Whether a message is a pitch also depends on who you are. "Can you help us rank higher on Google?" is a lead for an SEO agency and a pitch to a plumber. A keyword filter doesn't know which business it's protecting, which is why blocking "SEO" or "ranking" eventually costs someone a customer.

Free ways to handle the pitches

  • Add a "What's this about?" dropdown. Use options like "New project", "Existing customer" and "Selling a product or service". Some sellers pick the honest one and are easy to filter. Others pick "New project" anyway.
  • Give vendors their own address. A line under the form like "Selling something? Email vendors@yourdomain.com" gives salespeople somewhere to go that isn't your main inbox.
  • Say it on the form. "No sales or SEO pitches, please." It's free and it's weak. Some people respect it. Bots don't read it.
  • Filter in your inbox, not the form. A Gmail or Outlook rule can move form emails containing "guest post", "backlinks" or "SEO audit" into a folder you skim. Pitches get reworded all the time, so the list needs constant upkeep, and now and then a real customer lands in there.

Blocking at the form usually means the message never reaches you; filtering in your inbox just moves it. For anything that might be a customer, moving beats blocking.

Where Ascue fits

Ascue reads every message after the visitor hits submit, so there's no CAPTCHA, and gives it one of four labels. Lead goes to your inbox right away. Pitch is held for a weekly digest, or delivered tagged, your choice. Spam is blocked and kept for 30 days. Ask me is delivered marked "Ascue wasn't sure", and one click confirms or corrects it.

It reads a one-sentence description of your business with every message, so the SEO agency and the plumber get different answers. When in doubt, it delivers. Nothing is deleted, and held messages can be released for 30 days.

For WPForms, point the form's notification email at your private Ascue address, or use the WordPress plugin, which falls back to the form's normal email if Ascue doesn't answer within a few seconds. The WPForms setup docs cover both. It's free for your first 50 messages a month.