Contact form spam across client sites — an agency playbook
Every client asks why the contact form is full of spam again. A playbook for agencies: inventory the forms, standardise the basics, agree a threshold per client and put it in the retainer.
Practical notes on the form on your own site: what it sends, where it sends it, who actually reads that mailbox, and what it costs you when nobody does.
Every client asks why the contact form is full of spam again. A playbook for agencies: inventory the forms, standardise the basics, agree a threshold per client and put it in the retainer.
A shared info@ address feels safe and quietly loses enquiries. How to route each contact form to a named owner, cover absences and leavers, and keep fewer copies of personal data.
Your visitor did not send that email — your web server did. What wp_mail actually does, what SPF, DKIM and DMARC check on the way in, and why a form's “sent” does not mean delivered.
A CAPTCHA checks whether a visitor is human, not whether they wrote to you. What reCAPTCHA, hCaptcha and Turnstile do now, what they cost real visitors, and when they are worth it.
Every layer Contact Form 7 offers in 2026 — what each one catches, what it costs the visitors you want to hear from, and why the well-written pitches walk through all of them.
Change one setting in your contact form. Spam stops arriving, and real enquiries go to whoever should answer them. Try it for a week with nothing switched on.
We would like to count visits with Google Analytics, which sets two cookies. Decline and nothing is loaded and nothing is sent. What these are.