Your Enquiry Form Is a Front Door, Not a Mailbox: Keeping Bot Spam Out Without Shutting Customers Out

A contact form is one of those small business fixtures that nobody thinks about until it goes wrong. For months it quietly does its job. Then one Monday the shared inbox is full of messages offering SEO services, claiming to have spotted a problem with your website, or asking for a quote in broken sentences with a suspicious link attached.

The form itself has not broken. It is simply doing what forms do: accepting input from anyone who finds it. The trick is to stop treating every submission as a genuine enquiry and start treating the form like the front door of your business. You want real customers to walk in easily. You do not want every passing bot to wander into the office and start shouting.

Start with the boring question: who actually reads it?

Before changing a single field, work out where form submissions land. In plenty of small UK firms, they go to an inbox that belongs to one person, usually someone who is already busy. That creates two problems. First, real enquiries can sit unread when that person is on leave. Second, spam gets mixed in with invoices, supplier messages and client questions, which makes it harder to spot the dangerous stuff.

Move form notifications to a shared mailbox or a group address that at least two people can access. Give it a clear label, such as 'Website enquiries', and set up a simple auto-reply that tells the sender their message has arrived and when they can expect a human response. The auto-reply should come from a monitored address, not a no-reply one. A customer who replies to a no-reply address has just hit a wall.

Make the form slightly harder to love

Bots are not fussy. They look for forms they can fill in quickly and repeatedly. You do not need an enterprise-grade fortress to put them off. You need a few low-friction checks that real people barely notice.

A honeypot field is the simplest place to start. It is a hidden field that a person cannot see or fill in, but an automated script often will. If the field has content, the submission is quietly discarded. Add a time check as well: if a form is completed in two seconds flat, that is not a human reading your questions.

Rate limiting helps too. If one IP address sends ten enquiries in a minute, something is wrong. Your web developer or hosting provider can usually apply basic limits without turning the form into a puzzle. If you use a CAPTCHA, favour one of the modern invisible or low-friction options rather than a grid of traffic lights that makes genuine customers sigh. Whatever you choose, test it with a screen reader or ask someone who uses accessibility tools. A security control that locks out real people is not a win.

Validate before it reaches you

Some spam is easy to filter because it is obviously rubbish. Some is designed to look like a real enquiry. Validation will not catch everything, but it raises the cost of a successful submission.

Make the important fields required, and keep the form short enough that a genuine customer will finish it. A dropdown for enquiry type is useful: new project, support request, billing question, something else. It helps with routing later and makes automated submissions slightly less uniform.

Be careful with links in the message field. You probably cannot block all URLs without breaking legitimate enquiries, but you can stop the form from accepting file uploads unless you genuinely need them. If you do need uploads, restrict file types and sizes. A contact form is not a file-transfer service.

Let the filter do the first pass

Once the form is a little harder to abuse, give your email filtering a chance to help. Create a rule that tags all form submissions with a consistent subject prefix, such as [WEB], and route them into a dedicated folder or shared mailbox view.

From there, use your email platform's spam filtering to quarantine obvious rubbish rather than deleting it outright. Auto-deletion feels satisfying for about a day, until a real enquiry gets caught by mistake and nobody can prove it ever arrived. A quarantine folder gives you a recovery route.

Check the quarantine weekly at first. Look for false positives: genuine customers whose messages were flagged because they included a link, wrote in a hurry, or used an unusual email domain. Adjust the rules rather than asking staff to remember a growing list of exceptions.

Route real enquiries like they matter

Spam control is only half the job. The other half is making sure a genuine enquiry reaches a human quickly. Decide who owns the shared mailbox each day, and what happens when that person is off. A rota sounds bureaucratic for a small firm, but a one-line rota is better than an inbox nobody checks on a Friday afternoon.

Set a simple internal standard: genuine enquiries get a human reply within one working day, even if the reply is just 'Thanks, we have seen this and will come back to you by Thursday.' That sort of message costs seconds and stops a customer wondering whether the form worked.

A ten-minute triage routine

You do not need a security operations centre. You need a short, repeatable habit. Once a day, open the form folder and sort what you find into three buckets: genuine, unsure, and junk.

Genuine messages get forwarded or assigned to the right person. Unsure messages get a cautious reply or a phone call if the details look plausible but odd. Junk gets quarantined, not debated. If a message contains a link asking you to sign in, update payment details, or 'confirm your account', treat it as phishing until proven otherwise. Do not click the link to see where it goes. Check the sender through a known channel instead.

Once a month, spend ten minutes looking at the pattern. Is the spam volume rising? Are certain phrases getting through? Is a real customer complaining that their enquiry vanished? Those signals tell you whether to adjust the form, the filter, or the routine.

The point is not a perfect form

No contact form will ever be completely spam-free. The aim is more modest and more useful: keep the obvious rubbish away from the people who need to answer real questions, and make sure a genuine customer never has to wonder whether anyone is home. That is not a big IT project. It is a few sensible settings, a shared inbox, and a ten-minute habit. In a small business, that is usually enough.