Reducing Contact Form Spam on Your Hosting Without a Captcha

Contact form spam is a common reason customers ask us to “turn on more security”. Spam is a real cost to a hosting account, but the most effective filter for it usually sits in front of the server, not on it. This article explains what spam submissions do on a WP Alpha server, why a Cloudflare country rule is often a better tool than a captcha, which parts you control yourself, and when it is worth opening a ticket.

What a spam submission costs the server

A contact form submission is not a cached page view. Each one runs WordPress and PHP, passes through the form plugin, often writes an entry to the database, and usually sends at least one email from the hosting account. One submission is trivial. Hundreds a day add up to wasted PHP workers, a growing entries table and a lot of outgoing mail that nobody wants.

The email side matters more than most people expect. Notification emails triggered by spam still leave from your domain, and a large volume of junk messages is not good for how mailbox providers view that domain. Keeping spam away from the form protects your inbox and your sending reputation at the same time.

Why the server firewall does not catch all of it

The firewall on WP Alpha servers is built to stop attack traffic: known malicious patterns, brute-force logins and abusive bots. Contact form spam often looks like an ordinary visitor filling in an ordinary form. The request is well formed, it arrives at a normal rate and there is nothing technically wrong with it. Blocking it at server level would mean blocking real enquiries as well.

What spam usually does have in common is where it comes from. For a business that serves one country, most junk submissions arrive from somewhere else. That is the pattern the rule in the video uses.

The captcha trade-off

The usual answer to spam is a captcha such as Google reCAPTCHA. It works, but it adds a fair amount of JavaScript that every visitor has to download. Some plugins load it everywhere: Contact Form 7, for example, includes reCAPTCHA on every page whether or not the page has a form. Visitors also find image puzzles irritating, which is not ideal on the page where you want them to get in touch.

The Cloudflare country rule

If your domain uses Cloudflare, a single custom rule can send every visitor from outside your target country through Cloudflare’s automatic browser check before the request reaches us. Real people pass in a moment without clicking anything. Most spam scripts do not. The rule shown in the video, for an Australian site, is:

(not ip.geoip.country in {"AU"} and not cf.client.bot)

• Change the country to the one you serve. UK customers would use GB and US customers US. You can list several countries, or match a whole continent instead.
• Keep not cf.client.bot. It exempts Cloudflare’s list of verified crawlers, which includes Google and Bing. Without it the rule would challenge search engines too.
• Set the action to JS Challenge, the automatic check. The video recommends against Managed Challenge and the legacy image captcha because they can ask real visitors to solve a puzzle.

You add it in your Cloudflare dashboard under Security, then WAF, as a custom rule (older dashboards call these firewall rules). Use Edit expression, paste the text, set the action and deploy.

What you control and what we control

Cloudflare rules live in your own Cloudflare account, so you can add, edit and remove them yourself at any time, and you can see every challenged request under Security, then Events. The form plugin, its spam settings and any captcha are also yours to change in wp-admin. The server firewall, the mail server and the server logs are on our side.

One side effect to plan for: services that fetch your site from overseas data centres will meet the challenge too. Uptime monitors, SEO crawlers and some integrations fall into this group. If something legitimate stops working after you add the rule, find it in Cloudflare’s events and add an exclusion for its user agent, as the video does for several SEO tools.

When to open a ticket

• Your domain is not on Cloudflare and spam is still heavy after you have tidied up the form plugin’s own settings.
• A legitimate service is refused and you cannot find the block in Cloudflare’s events, which suggests it is happening on the server.
• Real enquiries stop arriving, or form notification emails are going missing.

Open the ticket from the client area and include the form page URL, the approximate time of a few spam or missing submissions, the form plugin you use and whether the domain runs through Cloudflare. With that our support team can check the server and mail logs for those exact submissions rather than guessing.