Every public form gets found eventually. A few days after a new contact form goes live, the first strange entries arrive: a name made of random letters, a message offering backlinks, a block of text in a language nobody on your team speaks. A week later there are more of them than real inquiries, and someone has to sort through the pile before anyone can answer actual customers.
The good news is that you can stop form spam to a level where it no longer costs you time, and you can do it without turning your form into an obstacle course. It takes a few layers rather than one trick. Below we explain where form spam comes from, which captcha fits which situation, how field choices make a difference, and how to keep the spam that slips through from spreading into your CRM and newsletter list. We use Deftform as the example, since that is the form builder we know best.
Most form spam is automated. Scripts crawl the web looking for anything with a submit button, fill in every field they find and send the result. A bakery's catering form and a law firm's contact page look the same to them.
A smaller share comes from people who are paid to paste the same marketing pitch into thousands of contact forms by hand, which is why that SEO offer sometimes reads almost personal. Others try to abuse forms that send automatic replies.
That last case deserves attention. If your form sends a confirmation email to whatever address someone enters, a bot can enter strangers' addresses and use your form to flood their inboxes. The recipients mark your emails as spam, and your domain's sender reputation pays for it. Your own newsletters may then land in junk folders too.
Deleting a few fake entries takes minutes. The real cost shows up later:
Integrations copy the spam. If submissions create contacts in HubSpot, rows in Google Sheets or messages in Slack, every fake entry ends up in all of those places.
Real leads get buried. When half the notifications are junk, people stop reading them carefully, and a genuine inquiry waits two days for an answer.
Agencies have to explain it. A client who finds a hundred fake leads in their CRM will ask who set up the form.
A captcha tries to confirm that a human sent a submission before it is accepted. Modern options mostly work in the background and only ask for interaction when something looks suspicious. They differ in how much friction they add and what data they collect.
Google reCAPTCHA in its current versions evaluates how a visitor behaves on the page and scores how human they seem, usually without showing a puzzle. It is familiar and needs little setup. The trade-off is privacy. Information about the visitor goes to Google, which belongs in your privacy policy and, depending on your setup, may require consent in the EU.
Cloudflare Turnstile is free and also runs mostly invisibly. It is a good choice if your website already uses Cloudflare, because you can see reports for your forms in the same dashboard you already use for the rest of the site.
ALTCHA takes a different approach. Instead of watching visitors, it asks their browser to solve a small computing task before the form can be sent. For a person this takes a moment and a single click. For a bot sending thousands of submissions, the work adds up quickly. ALTCHA works without cookies or tracking and doesn't collect personal data, which makes it the easiest of the three to explain in a privacy policy.
No captcha catches everything, and anyone who promises zero spam is overselling. A captcha removes the bulk of automated junk, though, and that is usually most of it. If you build forms yourself rather than using a form builder, remember that the captcha token has to be verified on the server. A widget that only runs in the browser can be skipped by any script that posts directly to your endpoint.
In Deftform, captcha protection is set per form. We support all three options described above:
Open the form in the form builder and go to its settings.
In the General section, find the Captcha dropdown.
Pick Google reCAPTCHA, Cloudflare Turnstile or ALTCHA and save.
ALTCHA and reCAPTCHA need no further setup on your side. For reCAPTCHA we handle the keys and domain whitelisting. Turnstile works with your own keys, because Cloudflare limits how many hostnames one key can cover. You add your site key and secret key once in the workspace connection settings, and every form in that workspace can use them. Our help center has a short overview of the captcha options in Deftform.
If you are unsure which one to pick, we recommend ALTCHA. It is the most privacy-friendly option, and for most contact and lead forms it stops form spam well without asking visitors to do anything more than tick a box.
Bots are lazy in a predictable way. They love long free-text fields, because that is where links and sales pitches go, and they fill in every field they see. A few design choices make your form less attractive and make the junk that does arrive easier to spot.
Use specific field types. Email, phone and number fields are built for one kind of input, while a form made only of short and long answer fields accepts anything.
Replace free text with choices where you can. "What do you need help with?" works well as a dropdown or single choice field. You get cleaner data and give scripts one less place for their message.
Drop the website field unless you need it. On contact forms it mostly collects spam links.
Show extra fields only when they matter. With conditional logic, the long answer field for project details can appear only after someone selects "Request a quote".
Ask one qualifying question. A required field such as company size or budget range takes a real visitor two seconds and makes careless submissions stand out right away.
Shorter, more specific forms also convert better with real people. We cover that side in our guide to high-converting forms.
Some junk will get through every defense, so plan for what happens after a submission arrives. The aim is to stop one fake entry from turning into five.
Start with automatic replies. If your form sends a confirmation email, keep it short and free of marketing content, so it is useless to anyone trying to misuse it. For newsletter signups, use double opt-in through your email marketing tool, so an address only joins your list after its owner confirms it.
Next, look at where submissions go. A form connected directly to your CRM will create a contact for every entry it receives. If spam is a recurring problem on a particular form, send its webhook to an automation tool such as Make or Zapier first and add a simple filter there, for example one that holds back submissions with links in the message field or a missing answer to your qualifying question.
Finally, keep an eye on the numbers. A sudden jump in responses that doesn't match your traffic is usually the first sign that something has found your form. Deftform shows visits and responses for each form, so it is easy to compare the two and react before the junk piles up.
Not every form has to be public. A client onboarding questionnaire, a project briefing or an internal request form only needs to reach the people you send it to. Share those as direct links by email instead of placing them on a public page, and they will rarely be found by crawlers at all.
For forms that should be public, a custom domain helps in a different way. When the form runs on forms.yourcompany.com, respondents see your brand and are more likely to trust the confirmation email that follows. Deftform includes a custom domain on every plan. And once a campaign is over, take its form off the page rather than leaving it to collect junk for the next two years.
Your choice of captcha is also a data protection decision. A tool that sends visitor data to a third party has to appear in your privacy policy, and some setups need consent before it loads. A privacy-friendly option like ALTCHA keeps that conversation short. If you collect personal data from people in the EU, our practical guide to GDPR compliant forms covers the rest of the picture, from legal bases to retention periods.
Agencies run forms for many clients at once, which multiplies the spam. A short routine helps:
Agree on a captcha with each client and make sure it matches the client's privacy policy.
Turn on protection before a form goes live, not after the first wave of junk.
If a client uses Cloudflare, add their own Turnstile keys to the client's workspace.
Check every integration that receives submissions, especially CRMs and newsletter tools.
Review response numbers once a week during campaigns.
Deftform gives every client a separate workspace with its own forms, team members, custom domain and settings, which keeps spam settings and keys apart as well. Our page on Deftform as a form builder for agencies shows how that works for client work.
We at Deftform build a deliberately simple form builder, made and hosted in Germany. Every form can be protected with ALTCHA, Cloudflare Turnstile or Google reCAPTCHA, and every plan includes unlimited responses, unlimited team members and a custom domain. Each account comes with three workspaces, each with its own domain, custom styles, API access and webhooks, and you can take payments through your own Stripe account.
You can buy forms pre-paid at €4 per form in packs of five, choose the Complete plan at €25 per month, or pay once for the Lifetime package at €189, which is also available as 12 monthly payments of €16.
If your current form is drowning in junk, create a Deftform account, rebuild it with the right field types and switch on ALTCHA before you share the link.