“Field Notes: Bots Found Our Forms in Week One”
This one is from our own operation. Within days of our website going live, the contact form started collecting visitors that were not visitors: automated submissions hawking SEO services, fake partnership offers, and word salad with a link in the middle. No person had found the site yet. The bots already had.
If your business has a form on the internet, this is your reality too. Here is what we learned setting up our defense, and the one principle we think most small businesses get wrong.
Spam is not the risk. The filter is.
The obvious cost of form spam is annoyance: junk in the inbox, real inquiries buried. So the obvious response is aggressive filtering, and every tool is happy to sell you one that deletes suspicious submissions before you ever see them.
Slow down at that word, delete. A lead that never existed and a lead your filter silently discarded look identical from your side: you see nothing. For a founder-operated business, one real inquiry can be worth thousands. A filter that guesses wrong once a month may quietly cost more than the spam it stops.
So we built our defense around a single rule: flag, never drop. Every submission gets stored. Suspicious ones get marked and held out of the daily flow, but a human can always review the holding pen and rescue a false positive. The filter's job is triage, not execution.
Layers beat any single trick
The second lesson: no one defense works alone, because bots are varied and lazy in different ways. A layered setup, each layer cheap and independent, catches far more than one clever wall:
- A honeypot field. An invisible form field humans never see. Automated scripts fill everything, so a filled honeypot is a near-certain bot signal. Costs nothing, catches the dumbest and most numerous offenders.
- Timing checks. People take a while to fill out a real form. Scripts post in a blink. Submissions that arrive impossibly fast earn a flag.
- A modern challenge. Current verification services can screen most bots without making humans click traffic lights. We chose one that fits our privacy stance; whatever you pick, confirm the check runs on the server, not just in the browser, because bots do not politely run your page's checks.
- Content sanity checks. Disposable email domains and link-stuffed messages are weak signals on their own, so they flag rather than condemn. Signals combine before anything gets marked as spam.
Notice what each layer does when it fires: it marks the submission. Nothing is deleted. The layers disagree sometimes, and that is fine, because disagreement lands in a review queue instead of a void.
What this looks like for your business
You do not need custom development to apply the principle. Most form and CRM tools can tag or quarantine instead of delete; the setting is usually one option away from the destructive default. Turn on the boring protections your tools already include, add a challenge service if volume gets painful, and route suspected spam somewhere a human glances weekly instead of into deletion.
Then measure the thing almost nobody measures: check the quarantine occasionally for real people. That five-minute habit is the difference between a filter you trust and a filter you hope is right.
Bots found our forms in week one. They will find yours. Filter hard, keep everything, and never let an algorithm make the final call on a potential customer.