Contact Form Spam Protection: How WizeForm Keeps Bots Out

Any publicly accessible form endpoint will be found by automated bots. Some are scanning for vulnerable endpoints, others are programmatically submitting promotional content, and others are phishing operations that use contact forms as a delivery mechanism. Once your form is live on a real domain, the volume can start within hours — not days.

The damage isn't just a cluttered inbox. Every spam submission that reaches your email costs attention that could have gone to a real lead. Every bot submission that consumes your monthly submission quota is quota you didn't choose to spend. And if spam submissions aren't filtered, they pollute your dashboard and make filtering for real leads harder.

Building your own spam protection means setting up and tuning rate limiting, adding honeypot fields to your HTML with hidden CSS, integrating a third-party CAPTCHA service, and maintaining all of it as bots evolve their tactics. WizeForm handles the entire protection stack automatically from the moment you create your access key.

The first layer is rate limiting, enforced per access key and per IP address. When requests from a single source exceed a reasonable threshold in a short window, they are silently rejected with a 429 response. Real users submitting a contact form will never hit this limit. Bots running submission loops will. This layer catches the bulk of automated abuse before any content processing happens.

The second layer is honeypot field detection. WizeForm injects a hidden field into the form validation flow — a field that is invisible and inaccessible to human users but that automated bots, which fill all available fields, tend to populate. Any submission that includes the honeypot field value is silently flagged as bot traffic and removed from your inbox and quota.

The third layer is WizeForm's AI scoring. The same model that scores legitimate submissions for lead quality also recognizes the patterns that characterize spam: incoherent text, templated promotional language, repetitive phrasing, and other signals that distinguish automated submissions from human ones. Submissions flagged by the AI are routed to a separate spam queue in your dashboard, not to your inbox, and do not count against your monthly quota.

All three protection layers are active by default for every WizeForm access key. There's nothing to enable, no thresholds to tune, and no external service to configure. The moment your form goes live with WizeForm, it has rate limiting, honeypot protection, and AI spam filtering running in the background.

If a legitimate submission is incorrectly flagged as spam — which can happen with very short messages or unusual formatting — you can find it in the spam queue in your WizeForm dashboard, review the full content, and mark it as not spam. WizeForm moves it to your main submission list and sends the notification retroactively.

Marking miscategorised submissions corrects future filtering for your access key specifically. The AI model takes the feedback into account, so your spam filter becomes more accurate over time as it learns what real submissions look like for your particular form and use case.