How to Stop Contact Form Spam Without CAPTCHA (Use an AI Spam Detector)

Every public contact form attracts spam: SEO offers, crypto scams, fake invoices, link dumps and bots testing for weaknesses. A CAPTCHA stops some of it, but it also annoys real visitors, can hurt conversions and fails against modern bots and click farms. The better approach is invisible: several lightweight checks that cost real people nothing. This guide explains how contact form spam works, shows the four layers that stop most of it and explains how to add an AI spam check, with a free tool you can try first.

1. Why contact forms get spam

Forms are open doors. Anyone can submit them without an account, and the messages usually land in an inbox someone reads. Spammers use three methods:

• Automated bots that find forms and post the same message everywhere. They fill every visible field.
• Human-assisted spam, where a person or a script with a real browser submits promotional messages for SEO, web design or marketing services.
• Probing and injection attempts, where a bot tries to send email headers, scripts or links to see whether the form can be abused.

The damage is more than annoyance. Spam hides real leads, costs time to read, and if your form sends an automatic reply it can turn your domain into a spam source and hurt your email reputation.

2. Why CAPTCHA is not the whole answer

A CAPTCHA asks the visitor to prove they are human. It works against basic bots, but it has real costs:

• Friction. Every real visitor has to solve a puzzle, and some give up, especially on mobile.
• Accessibility. Image puzzles are hard for people with visual impairments, and audio versions are not always better.
• It does not read the message. A human-assisted spammer passes the test and still posts an advert. Services that solve CAPTCHAs for a few cents also exist.

That is why a CAPTCHA works best as one layer, used only when other signals look suspicious, not as the only defence.

3. The 4 layers that stop most spam

Layer 1: A honeypot field

Add an extra input, hide it with CSS, give it an attractive name like website and tell assistive technology to skip it. Real people never see it, so never fill it. Bots fill every field, so any message with a value in it is spam, and you can answer with a normal-looking success message so the bot learns nothing.

Layer 2: A minimum fill-in time

Record the time the form was shown and reject messages sent in under two or three seconds. A person cannot read, type and submit that fast. Pair it with a signed timestamp so a bot cannot fake it.

Layer 3: Rate limits

Limit how many messages one IP address or session can send in a short period, for example five per hour. This stops floods without affecting normal use. If your site is behind a proxy or CDN, make sure the limit uses the visitor's real IP address, not the proxy's.

Layer 4: An AI content check

The first three layers look at behaviour. The fourth looks at meaning, which is what catches the spam that gets through. It is covered in the next two sections.

4. How an AI spam detector works

Older spam filters count words such as "free" or "winner" and block lists of known bad domains. Spammers get around them by changing a few characters or using a new link. An AI detector reads the message the way a person would and asks: does this make sense for this form, or is it an advert, a scam or a junk link?

The model looks at signals such as:

• Unrelated promotion, for example an SEO or web design pitch sent through a plumber's contact form.
• Pressure to click or reply quickly, and claims that sound too good to be true.
• Links that have no reason to be there, or text that looks copied and pasted.
• Generic messages that could have been sent to any site, with no detail about your business.

The result is a verdict, a spam score from 0 to 1, a category such as promotional or phishing and a short reason. The reason is useful: you can show it to whoever reviews borderline messages.

5. Try the free AI spam detector

You can see how it judges your own messages before writing any code. Paste a contact form message, comment or review into the free spam detector, choose the content type and strictness, and press Check for spam. You get the verdict, the score and the reason in a few seconds.

6. Add the check to your form

The same detector is available as the spam detection API. Call it from your server (never from browser JavaScript, so your key stays secret) after the honeypot and rate-limit checks have passed.

curl -X POST https://rsflowhub.com/api/v1/ai/spam-detection \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "text": "Hello, we can put your website on page 1 of Google in 7 days. Reply for a free audit.",
    "content_type": "contact_form",
    "strictness": "medium"
  }'

The answer arrives in data.result with is_spam, spam_score, spam_category and reason. Here is the decision logic in Node.js:

export async function classifyMessage(text) {
  try {
    const res = await fetch("https://rsflowhub.com/api/v1/ai/spam-detection", {
      method: "POST",
      headers: {
        "X-API-Key": process.env.RSFLOWHUB_KEY,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ text: text.slice(0, 5000), strictness: "medium" }),
      signal: AbortSignal.timeout(10000),
    });
    if (!res.ok) return "review"; // fail safe: a person looks at it
    const { data } = await res.json();
    const { is_spam, spam_score } = data.result;

    if (is_spam && spam_score >= 0.85) return "spam";    // drop quietly
    if (is_spam || spam_score >= 0.5) return "review";   // review folder
    return "inbox";
  } catch {
    return "review";
  }
}

Two design choices matter. The text is cut to 5,000 characters, the maximum the endpoint accepts, and any error returns review instead of blocking the message. If the check is ever unavailable, a real customer still gets through.

Prefer not to build this yourself? RSFlowHub Forms adds a contact form with spam filtering to any site with one script tag. For a Python version of the code above, see Detect Contact Form Spam with Python.

7. Tuning strictness and handling false positives

• Low strictness flags only obvious spam. Use it when your messages are short and informal, or when losing a real message would be costly.
• Medium is a balance for most sites and a good default.
• High flags anything suspicious. Use it for public comment sections that attract heavy abuse.

Keep a simple log of what was flagged and review it weekly for the first month. If real enquiries appear in the spam list, lower the strictness or raise the score you need before auto-dropping a message. If spam keeps reaching the inbox, raise it. Always keep a way to restore a message.

Related guides

Setting up the form itself? Read Contact Form Without a Backend. Writing the reply to a real enquiry? See How to Reply to Any Email. Collecting newsletter signups safely? Read Newsletter Double Opt-In Explained.

Frequently Asked Questions