How To Prevent Spam Form Submissions: 9 Tips To Identify & Avoid Spam

Those pesky bots have a mind of their own! It can be discouraging to receive a form submission on your website and see that, yet again, it’s illegitimate.

Before we can learn how to prevent spam form submissions, we must first learn its definition and how to identify spam, which we’ll cover below.

What Is Spam?

If the first thing that comes to mind when you hear spam is (questionable) canned meat, you’re on the right track — this is actually where the name came from! In a humorous Monty Python scene, Vikings portray the fact that spam is repetitive and unavoidable, much like the website spamming we’ll be talking about in this blog.

While there are many different types of spam, we’ll focus on contact form spam.

Contact form spam is when a non-human submits contact forms through your website. Let’s go through an easy checklist to help you determine if you’re receiving legitimate or spam form submissions.

How To Identify Spam

1. Visit The User’s Website

If your contact form has a field for the user’s website, business name, or if the website address is listed at the end of the email address they include, visit the site. If the domain isn’t valid, or the site doesn’t match what is listed in their message, this could be an indication that it’s contact form spam.

2. Investigate The User’s Email Address

In addition to examining their website, you’ll also want to check out their email address. 

• Is it a company email address? 
• Does it match the business name they listed? 
• Is it a legitimate company with a working website? 
• Is it a common email address like Gmail, or does it use one you’ve never heard of?

3. Match The Service They Selected With The One In Their Message

If there is a form field/dropdown menu for the user to select which service they’re interested in, you might be able to match it with the service(s) they mentioned in their message. If they don’t match, it could be an indication that they didn’t adjust the dropdown and went with the default, which could mean it’s a bot.

4. Read Through The Message For Gibberish

If you’re seeing a bunch of random capital letters, numbers, letters, typos, etc., this is typically a clear indication that those are spam form submissions.

5. Look At The ReCAPTCHA Score

If you’ve installed ReCAPTCHA to help you identify bot traffic, you’ll notice a ReCAPTCHA score from 0.0 to 1.0. The closer it is to 1.0, the more likely the user is a human.

6. Identify The Source/Medium

Match the form submission on your site with the form submission that’s listed in GA4. In most cases, you can see the time of day, location, browser, and more. If the source is paid search, dig deeper into the data in your Google Ads account to learn more about where it’s coming from: 

• Campaign
• Ad group
• Keyword
• Landing page
• Audience segment(s)
• Income level
• Age
• Gender
• Mobile or desktop

Are they all coming from a certain location? Do they come from the same campaign? Is a certain audience segment attracting the wrong type of people? Note any patterns you see.

7. Compare The Bad Leads To The Good Leads

Use the criteria above to evaluate your good leads as well. Do you notice any key differences? Perhaps you’re noticing that your spam form submissions primarily come through mobile devices and your legit form submissions mainly come through desktop. 

Another example could be that if you notice your good leads are coming through organic search, but spam leads are coming through paid search, you then have insight into which channel to examine closer.

8. Check The Change History 

Check out the change history in your Google Analytics and/or Google Ads account to ensure nothing out of the ordinary happened around the time you started seeing spam. Perhaps a setting got bumped, or a certain keyword was added.

9. Explore The User Journey

What was the user journey like? Set up an explore report in GA4 to get a better idea of user engagement metrics. Identify the actions they took, how long they spent on the site, when they first came to your site, and more. If you find that those users only spent a few seconds on the page, and took no other actions, it could indicate bot traffic.

How To Prevent Spam Form Submissions

While there is no way to completely eliminate spam form submissions, we have several spam prevention tips:

1. Turn Off Search Partners And/Or The Display Network

If you’re noticing spam form submissions coming through paid search, segment it by “Network” to see where the traffic is coming from. 

If it’s coming through Search Partners or the Display Network rather than Google Search, you can turn those settings off. There are two places you’ll need to uncheck the boxes: In the campaign settings and in the auto-apply recommendations section (see screenshots below).

2. Adjust Keyword Match Type

While using broad match keywords can help you reach a large audience, that audience can also bring in a lot of spam. Reach a more specific audience in your paid ads by using exact or phrase match keywords.

3. Narrow Your Geographic & Audience Targeting

If you service the entire United States, it might be tempting to target the US as a whole. However, certain cities, such as Los Angeles and New York City, might bring in more spam due to their size and popularity. If you’re noticing more spam through California and New York, try excluding those locations in your targeting.

A good amount of spam often comes from other countries. Try adding all other countries around the world to your excluded locations list to avoid spam. 

Tip: Use ChatGPT to quickly generate a list of all other countries around the world.

You may also want to select “Presence” rather than “Presence or Interest” for your geographic targeting. This will allow you to target only people who are IN that area, rather than people who have an interest in it/have searched for it in the past.

In Google Ads, you’re also able to see which audience segments and locations brought in the most conversions. If you see that a certain audience segment brings in more spam form submissions, remove it from your targeting.

4. Evaluate Keywords, Ad Copy, & Landing Pages

Sort through your targeted keywords and identify any that don’t have the correct intent that might be bringing in irrelevant form submissions. Put those into a negative keyword list to avoid showing up for them again.

Evaluate your ad copy to ensure it correctly represents the landing page you’re leading them to. Adjust any descriptions or headlines that may be misleading.

5. Mark As Spam In WordPress

In WordPress, you can click “Mark as Spam” to help train the system to recognize those types of form submissions as spam.

6. Use An Anti-Spam Tool, Such As ReCAPTCHA

By enabling ReCAPTCHA, users have to check a box, identify images, or answer a simple question to indicate they are human. They won’t be able to submit the form unless they answer correctly. 

As we mentioned above, ReCAPTCHA also gives out a score from 0.0 – 1.0 to help you identify which users are human. The closer the score is to 1.0, the more likely they are a human.

7. Set Up An Anti-Spam Honeypot

Website spamming can get your business into a sticky situation – but not to worry! Anti-spam honeypots can be a great tool to avoid spam. 

If this brings to mind an image of a trap with sticky honey, let’s continue with this thought for a second. A honeypot is a bot traffic detection technique that “traps” bots using a hidden field. The field isn’t visible to a human eye, but when bots go to fill out the form, they’ll fill it out by default, thus “trapping” them and giving away the fact that they’re a bot.

8. Utilize The Akismet Anti-Spam Tool

Akismet is another spam prevention tool – and it has 99.99% accuracy! With both free and paid plans, you can choose the option that works best for you. 

9. Access Tower Marketing’s Proprietary Validator Tool

When you work with an agency partner like Tower Marketing, you’ll have access to our custom, proprietary, Gravity Forms spam prevention solution, created by our very own web development team.