Start with the spam protection your contact form already provides, then check that a genuine customer can still submit and receive a useful confirmation. If automated junk keeps coming through, a supported service such as Cloudflare Turnstile can add a further check without asking visitors to solve picture puzzles. Blocking whole countries, common email providers or broad words is a poor first response when those rules could also reject a worthwhile enquiry.
For a small service business, the aim is a manageable inbox and a dependable route for new customers. Before changing anything, establish whether the unwanted message actually passed through the website form. Spam sent directly to your published email address needs a different remedy.
Find out where the junk enters
Compare a few unwanted messages with a labelled test enquiry that you have agreed with the person monitoring the inbox. Look for the form’s usual subject, field labels and any matching stored entry. A familiar subject is a clue, not proof: a sender can imitate it.
If your form stores submissions, compare the message with the entry and time. If it does not, ask the person maintaining the website which submission or mail records are available. Avoid forwarding real customer details around simply to demonstrate the problem; a redacted example and the relevant time are usually a better starting point.
- Junk accepted by the form: review the form’s anti-spam controls and their configuration.
- Spam arriving directly at the mailbox: review mailbox filtering with the email provider. Changing the form cannot screen messages that never use it.
- Genuine enquiries missing: follow the contact-form delivery checks before making the filters stricter.
Keep unsolicited sales pitches separate from obviously automated submissions when you assess the result. Someone manually offering an unwanted service may pass a check designed to distinguish a person from a bot. A more difficult challenge can inconvenience customers without solving that particular nuisance.
Use the protection you already have
Ask your developer to identify the active form plugin and inspect the actual form settings. Installing another plugin before doing this can leave you with overlapping controls and no clear idea of which one rejected an enquiry.
For example, WPForms documents built-in modern anti-spam protection and several additional integrations. Its modern protection depends on JavaScript working correctly. If a recent optimisation or script change coincides with submission failures, include that change in the investigation.
Agree one change at a time and retain a note of the previous setting. Run a legitimate submission through the complete journey after each change. Once you have a working baseline, you can judge whether another layer is needed from the junk that still gets through.
A minimum completion time deserves particular care on a short enquiry form. A customer using saved contact details may finish quickly. Likewise, a keyword rule can reject a legitimate job description if the chosen word has an ordinary meaning in your trade. Use narrow rules based on the messages you are receiving, with a way to review mistaken rejections where the tool supports it.
When Turnstile is a sensible next step
Cloudflare Turnstile is worth considering when automated submissions continue and your form builder has a maintained integration. It works independently of Cloudflare’s content-delivery network, so using it does not in itself require moving your website traffic or changing hosting. Its managed mode may ask for a checkbox; it avoids the image-selection puzzles familiar from some CAPTCHA systems.
WPForms includes a Turnstile integration in its free Lite version as well as its paid versions. Check the equivalent documentation if you use a different form builder. There is no reason to buy a larger forms package solely to obtain a feature already available in your current one.
The developer must check the integration beyond the visible widget. Cloudflare requires validation on the server before the submission is accepted. Its tokens are single-use and expire after five minutes, so the implementation also needs to handle a visitor who pauses while writing or returns after correcting an error.
Ask for a demonstration of both a successful enquiry and a failed verification with a usable retry. Do not accept a screenshot of a green tick as the whole test. If your existing protection is working well and customers can submit reliably, keep it.
Keep local customers able to contact you
If your service area is Formby, Freshfield and L37, state it on the page and ask for the job location. That is more directly relevant to whether you can do the work than treating the visitor’s internet connection as their service address. A customer arranging work for a relative may be browsing from elsewhere.
For the same reason, avoid rejecting every Gmail or Outlook address because junk has arrived from one. Many genuine household customers use those providers. Where an individual address repeatedly abuses the form, a specific block may be appropriate, but it should not quietly become a ban on a large group of potential customers.
Keep a visible alternative contact route that your business actually monitors. If verification fails, the message should tell the visitor what they can do next without clearing a long job description. W3C’s form-notification guidance explains why errors need clear text and a way to identify and correct the problem.
You can also reduce unsuitable enquiries through the questions and surrounding page copy. Our quote-form guide for tradespeople shows how to ask enough to assess a job without turning the first contact into an interview.
Check the customer journey after every change
Agree a small set of dummy enquiries with the business before testing. Use invented job details and an address you control, and make the test label obvious to whoever receives it.
- Submit on a phone and a desktop browser while logged out of WordPress. Include the ordinary short enquiry a customer might send.
- Try a quick submission using autofill, then a longer message with a pause before sending. Both should have a workable route through verification.
- Leave a required field empty, correct it and submit again. Check that the remaining answers survive and the error is understandable.
- Confirm the result at the form, any configured entry store and the intended inbox. Reply to the test to check the reply address too.
- Check the visible fallback contact route and assign someone to review reports of failed enquiries.
Keep the date, changed setting and result together. Over the following days, compare accepted junk, useful enquiries and any known false rejections. A quieter inbox alone cannot tell you whether the form has improved: it may also be failing to accept submissions.
If you want help reviewing an enquiry route for a Formby or Freshfield business, send Formby Web Design the page address and a description of the problem. Include whether you are receiving junk, losing genuine messages or seeing an error; customer messages and login details are not needed for an initial discussion.
