Combat Contact Form Spam

combating inbound spammer from forms
Home » Blog » Combat Contact Form Spam
Table of Contents
    Add a header to begin generating the table of contents

    There’s nothing more frustrating than opening up your email in the morning and seeing a new contact form submission has come in off your website and realizing its just another spammer sending you a pitch. Spam, especially in the United States, has become a serious problem. You’re literally being targeted by the entire world! It can be especially bad if your using a highly targeted CMS like WordPress to power your site. This article will go through some tactics to stop contact form spam, regain a little bit of your sanity, and restore hope when checking your new contact form submissions.

    Spammers Are Lazy

    One great thing I’ve learned is that many spammers are lazy. Many of them are super cheap resources in foreign countries playing the numbers game. The slightest bit of difficulty encountered usually results in giving up and moving on the to the next victim.

    When combating spam and trying to stop contact form spam presenting minor difficulties can be an effective method of defending your website.

    Blocking Copy Paste

    One effective method I’ve seen to stop contact form spam or stop form spam in general is to disable pasting on html textarea fields. Textarea fields are most often going to be your long form description fields where someone actually types the message they want to send to you.

    stop contact form spam disable paste on textarea
    Textarea field on a Tortoise and Hare Software’s Contact form

    Disabling paste on a field is bad for usability and accessibility so it’s something to be used very sparingly. Textarea fields are going to be where a spammer is most likely to copy their pre-written pitch and paste it into the text area. If they can’t do that they are very unlikely to be determined enough to manually write their entire message into the field and most likely will just close the browser window and move on to the next target on the list.

    How To Block Pasting To Stop Contact Form Spam

    There are two ways a spammer can paste something into a field, the keyboard and the context menu. The keyboard paste is most often accomplished using the well known ctrl-v command and the context menu paste is accomplished by pressing right click on the mouse within the field and then selecting paste from the context menu. We need to prevent both if we want to stop spammers from blowing up our inbound forms.

    context menu paste command stop spam
    Context menu with paste command

    This activity requires a developer to add some JavaScript to your page. Below is the base JavaScript you’ll need to add to block contact form spam.

    This code requires a teensy bit of customization so can’t be blindly copy pasted. There are two things you’ll need to update

    • YourEventTypicallyDocumentReady
    • YourFormFieldSelector


    In general you’ll want to run this code on document ready but certain plugins, ninja forms for instance, take advantage of that event handler already so you may need to hook into a custom after form ready event or later event. A developer should be able to help you figure this out.


    Next you’ll need to choose the form field selector you want to disable the appropriate form fields. This could range from a specific form with an element selected by #ID or a class that you use to tag all the form fields you want to disable paste on to stop contact form spam. .stop-spam for instance.

    stop contact form spam with a JavaScript developer

    If you’re feeling a little overwhelmed by any of the JavaScript, I’ve included a video walk-through with some additional commentary on working with the snippets below.

    YouTube video

    Stopping Contact Form Spam

    Unfortunately spam is an ongoing problem and in all reality it’s nearly impossible to block all spam. There are ways spammers could bypass this method but most of them are too lazy or don’t have the development capabilities to bypass. You can block a pretty significant portion of contact form spam with a small update to your JavaScript code. We hope you enjoyed the article and can benefit from this snippet! Got any other tips for stopping spam? Drop us a line, we’d love to hear from you.

    Share This Article
    Posted in:

    Hunter Nelson

    Hunter is the founder and president of Tortoise and Hare Software, a digital marketing agency for managed service providers. Hunter has more than 10 years’ experience building web applications and crafting digital strategies for companies ranging from scrappy startups to Fortune 50 household names. When not on the clock, you'll find him spending time with his family and pups, relaxing on the beach, or playing competitive online video games. See for more.


    1. Daniel on April 8, 2021 at 4:29 am

      Thanks for providing the JavaScript to disable pasting of text on our contact form! It reduced some of the spam that I received from my WordPress sites. However, some really determined spammers were able to overcome it by either disabling JavaScript on the browser or by typing out the entire spam message by hand.

      Instead of fighting this on the client side, I found a way of filtering out spam on the server side, using Artificial Intelligence (AI). By following simple instructions from this page: I was able to embed one line of HTML code on my WordPress site and let Artificial Intelligence figure out if a message is spam or not.

      I was able to weed out close to 95% of the spam from my contact forms since I embedded the code. It was really easy to implement, and best of all it’s free! Just thought your audiences might find this useful.

    2. barry - web designer on September 28, 2021 at 4:26 am

      onCopy=’return false’ onDrag=’return false’ onDrop=’return false’ onPaste=’return false’

      add this to your form fields.

    3. DCC Scotland on April 20, 2022 at 11:47 am

      blocking spam on contact form now days very easy. in word press so many plugin to use.
      Use WordPress Antispam Plugins
      Use the Honeypot Antispam Method
      Use a Custom CAPTCHA
      Use reCAPTCHA
      Block Traffic by IP Address

    4. Letting Agents Dundee on March 8, 2023 at 10:41 am

      I liked your website very much, it was nice and the article you published helped me a lot, thank you

    Leave a Comment