How to stop contact form spam without losing customers

In short

Combine a hidden field and a time check, which stop simple bots for free, with a filter that keeps what it catches instead of deleting it, explains why, and lets you undo it in one tap. Avoid anything that silently drops messages.

What a lost customer costs

A guesthouse in Hoi An, a dentist in Lagos and a plumber in Montréal get the same mail: search rankings, new websites, lists of leads, and invoices for services nobody ordered. Their customers write in Vietnamese, English and French, from free email addresses, sometimes in a hurry and sometimes through an AI assistant. A filter that mistakes one of them for a pitch costs a booking; a pitch that gets through costs a second of reading. Pick a way to filter that knows which of those two mistakes is worse.

Your options

Way	What it takes
A hidden field	Free and invisible to people: a field your page hides, which a bot fills in. It fails against a bot that reads the page as a person does, and against people paid to type pitches. W3C: Inaccessibility of CAPTCHA, §2.2.4 Honeypots
A time check	Free: a form sent two seconds after it opened was not typed by hand. A page left open for days, or a browser that fills the form in, can look odd too, so treat the time as a hint, not a verdict.
CAPTCHAs and challenges	A script on your page and a puzzle for your customers, which shuts some people out, including many people with disabilities. Some services price it by volume past a free allowance. It does nothing against a person typing a pitch. W3C: Inaccessibility of CAPTCHA (Group Draft Note, 16 December 2021) Google Cloud: reCAPTCHA tiers and pricing
Cloud spam checkers	Your visitors' messages go to the checker's servers, and plans are priced by site and by checks a month. Look at where what it catches goes: whether you can see it, and bring it back. Akismet: pricing
Filtering in your inbox (Surfing Dog Inbox, ours)	Free protection on every door, and three filters: on your own server free, with your own AI model or none; hosted, with Pro at $10 a month. What it catches waits under Spam or Held with its reason, kept for as long as you choose, one tap back. Open source. The spam filter How it decides
An AI check	Reads what a list of phrases can't, such as a pitch reworded a hundred ways. Each check costs money, and a message can try to give it instructions: send it masked text, check its answer in code, and never let it decide alone. OWASP: LLM01:2025 Prompt Injection

What a good filter does

It never drops a customer's message. What it catches is kept where you can see it, and comes back in one tap.
It says why, in a sentence: a hidden field filled in, the same message from forty senders, a link that goes somewhere other than it shows.
It doubts strangers, never someone you know. Someone you have answered, or let through once, is never put aside or held again; a check that points at a third party, such as a change of bank details, can still label them.
Language is never a reason. Nor is the script, the country, the email provider, spelling or a name.
A booking it doubts waits for the sender to confirm, and holds no time; it is never thrown away.

Set it up in four steps

Add a hidden field and a time check to your form. They are free and ask nothing of your customers.
Send what your form receives somewhere that keeps what it catches, with a reason for each.
For the opening week, label instead of putting aside: look at what it would have caught, and bring back anything that was a customer.
Test it as a customer would: from another address, in another language, asking for a price. It should reach you.

Our own inbox does all of this, with three filters you switch on: the spam filter.

Questions

Should spam be deleted automatically?

No. A filter is sometimes wrong, and a deleted customer is a lost one. Keep what it catches where you can see it, with the reason, for as long as you choose: for good, or a month or three.

Do I need a CAPTCHA?

Rarely, for a contact form. A hidden field and a time check stop simple bots without asking anything of your customers, and a puzzle does nothing against a person typing a sales pitch.

Can I filter with AI without sending my customers' details away?

Yes: take out email addresses, phone numbers and bank or card numbers before anything leaves, send just what the message says, and read the service's terms for how long it keeps what it's sent and whether it trains on it. Check the model's answer in code, so a message cannot talk it into anything.