Contact form spam, and a website that sends spam: stopping both

“We have a spam problem” means one of two very different things. Either your contact form delivers fifty junk messages a day, or your website is sending spam to strangers and your own email has started bouncing. The first is annoying. The second means someone is inside your server. They need different fixes, so first tell them apart.

Which one do you have?

Your inbox is full of form submissions selling SEO services, crypto, or nothing at all: form spam. Your legitimate email is landing in recipients’ spam folders, bouncing, or your host has sent a notice about outgoing mail: your site is sending spam. If you are not sure, ask your host for the outgoing mail log, or check whether your domain is on a blacklist using any of the free blacklist checkers.

Stopping form spam

Form spam comes from bots that find every form on the internet and fill it in. The defences, in order of how much they annoy real people:

1. A honeypot field. A hidden field that humans never see and bots fill in. Any submission with that field filled is discarded. Invisible to real visitors, stops most dumb bots. Every decent form plugin supports it.
2. A time check. A human takes at least a few seconds to fill in a form. A submission that arrives one second after the page loaded is a bot.
3. Server-side validation. Reject submissions with no real email, with a message that is only links, or that arrive at a rate no human could produce from one address. Our own contact form does exactly this: honeypot, validation, and a limit of a few submissions an hour from one address.
4. A modern challenge like Cloudflare Turnstile, which verifies visitors without a puzzle. Use this before reCAPTCHA, which frustrates real people and is easily solved by services that exist for the purpose.
5. A spam filtering service for the submissions themselves, such as Akismet or CleanTalk, as a last layer.

What not to do: a visible puzzle as the first line of defence. It costs you real enquiries, and the bots pay people to solve it.

Stopping a site that sends spam

This one is a compromise, not a configuration problem. Somewhere on the server is a script sending mail, and it got there through a hole. Treat it as a hacked site:

1. Ask the host to stop outgoing mail from the account while you work, so the damage and the blacklisting stop growing.
2. Snapshot the site.
3. Find the mailer script. Look for recently modified PHP files, PHP in the uploads folder, and unknown plugins. Search the file system for scripts that call mail functions from places that should not.
4. Find the door. Outdated software, a weak password, an old install in a subfolder. The mailer is the symptom.
5. Clean by replacement, rotate every password and the secret keys, patch everything, and follow the full cleanup order.
6. Get off the blacklists. Once the sending has stopped, request delisting from each blacklist that lists you. Most clear within a day or two once they see the spam has stopped.
7. Fix your own mail. Set up SPF, DKIM and DMARC records for your domain if they are missing, and send your site’s mail through a proper service rather than the web server. This is what makes your legitimate email trusted again, and it also stops others from spoofing your domain.

The one thing both have in common

Neither should be handled by the person who notices it at nine on a Monday. Form spam is a configuration you set once. Outgoing spam is a monitored condition: a daily check for changed files and a watch on your domain’s blacklist status. Both are standard parts of looking after a site, and both are quick to put right if you would like a hand.