Reduce contact-form spam without closing the door to real customers

Classify unwanted submissions before choosing a control

Review a small recent set of unwanted submissions. Are they repeated promotions, identical text, nonsense contact details or plausible enquiries from outside your service area? Outside-area requests may be genuine but unsuitable, which is different from spam. Give staff a consistent classification so the same kind of message does not receive a different label depending on who sees it.

Use supported filtering rather than blanket rejection

Wix documents built-in protection for new forms and a reviewable spam tab. Your response should fit the observed problem and the form version you actually use. A practical goal is less unwanted handling without rejecting ordinary people who type imperfectly, use privacy tools or need more time to finish. Do not describe any filter as a guarantee that all future spam disappears.

Source checks: Wix Forms: Protecting Your Site Forms from Spam · W3C WAI: Validating Input

Change one protection and retest normal inputs

Keep a baseline count of unwanted messages reviewed during a defined period, then adjust one supported setting. Prepare ordinary test requests with short descriptions, longer descriptions and realistic phone formatting. Avoid creating fake customer identities in public reviews or listings; private form tests should be clearly marked so they can be removed from enquiry reporting.

• Label a recent sample as unwanted promotion, invalid request, unsuitable genuine request or plausible customer enquiry.
• Check the platform's form version and available supported spam controls before making changes.
• Adjust one control and record its previous setting so it can be reversed.
• Submit marked legitimate tests from a phone and computer, including reasonable differences in writing and contact format.
• Review the flagged area for legitimate messages and assign a staff member to follow up where appropriate.

Look for false positives and operational blind spots

A filter that requires long messages can block a customer who writes 'need a quote'. Rejecting every external email domain can exclude people using work accounts. Increasing CAPTCHA friction may not address a routing problem that makes staff see the same notification twice. Do not delete a flagged queue without checking its retention behavior and preserving genuine requests that still need attention.

Measure useful requests alongside spam workload

Track unwanted messages handled, plausible messages incorrectly flagged and useful requests successfully received. Keep test submissions separate. If all submissions decline, check traffic and the completion path before declaring the filter effective. Record staff time qualitatively or with an actual time log; do not publish an invented percentage reduction as a customer result.

Assign a review window for flagged messages

Specify who reviews flagged requests and how frequently. During an active spam problem, use a review interval that fits the business's response expectations. Ensure the reviewer knows how to restore a legitimate message and record that restoration. Keep the website's verified phone or alternate contact method visible so a customer encountering a challenge has a usable next step.

Worked example: an illustrative customer journey

For example, a landscaper receives repeated sales pitches containing the same links, plus short legitimate messages such as 'Can you trim two trees?' The owner adjusts the supported spam setting and sends TEST-SPAM-401 with a short service question and TEST-SPAM-402 with a longer description.

Both legitimate tests should reach the normal submission queue. The owner then checks whether any real messages were flagged and whether repeated promotions continue. The tests show how the form handles those sample inputs. They do not establish a universal accuracy rate or justify rejecting all short messages.

Questions about this task