We implemented the below anti-spam question code into our html contact form. Also google recaptcha is active on the form. But still getting spam of dating and automated other spam messages.

Here is the anti-spam question code:

<td align=center><font class="err"><TMPL_VAR msg></font><label for="turingtest"> <strong>Anti-Spam Question:</strong> Which is the wrong name of this website?: example, link or example.com? *</label>
<input type="text" required="required" pattern="[ ]*(link)[ ]*" title="Pick the fluffiest animal"/>
<br><input name="send" type="submit" name="btn" value="<TMPL_VAR lang_send_message>"></td>

So this does not work. Maybe some automated spammers are using different techniques. What else we can do?

And how to implement much more powerful anti-spam question and approach into html contact form?

Here is the contact form part code:

<Table width="90%">     
        <td><TMPL_VAR lang_name>:<br /><input type="text" name="name" value="<TMPL_VAR name>" maxlength=32></td>
        <td><TMPL_VAR lang_email>:<br /><input type="text" name="email" value="<TMPL_VAR email>" size=24 maxlength=32></td>
        <td class="editor"><textarea id="message" name="message" rows=7><TMPL_VAR message></textarea></td>

    <TMPL_IF ihtml>
        <td align=center><TMPL_VAR ihtml></td>

Note: Using a server with CentOS and Apache. Plus perl script and their html pages.

1 Answer 1


It is impossible to completely stop spam submissions to your contact form. You can always get spam that is manually submitted. It is very possible to create a contact form that gets very little spam. I created a free open source contact form. I use it on all my sites and get just a handful of spam each month.

The main techniques for preventing spam with a contact form are:

  • Check all data server side. Don't rely on client side JavaScript to stop spam. If all your checks are executed client side in the browser, they are trivial for spammers to circumvent. You can use client side for usability. Users encounter errors more quickly. However, you can't use only client side verification.
  • Disallow HTML and bulletin board code for links. I allow bare URLs to be submitted, but block submissions with <a or [url . Many spammers are actually trying to submit comments with links to your site. This stops that.
  • Include hidden fields like <input type=hidden name=your-name and check to make sure it doesn't get filled in. Many bots try to put text in it even though users can't.
  • Use Google's recaptcha. The new "check the box" recaptcha is unobtrusive to most users and does a decent job of catching spammers. It will work better than your unsophisticated captcha.
  • Require a valid referrer from your site. Spammers often try to submit without a referrer header, but almost all users with real browsers have that.
  • Change the name of the fields. Instead of <textarea name=message use <textarea name=ce88o. Users never see what the name is, but obtuse names make it harder for spammers to figure out what data goes in what field.
  • I added the part of contact form's code, can you look at that?
    – Fixiywp
    Dec 4, 2020 at 18:09
  • I'm don't think that adds any new information. Dec 4, 2020 at 18:15
  • ok can you give me a detail step by step for doing the above?
    – Fixiywp
    Dec 5, 2020 at 6:54
  • I can't give you detailed instructions here, its too much. My open source contact form which I linked above implements all those features. The easiest way to get all those features is to use it. I have full instructions on my site for setting it up. If you really want to build you own and need hints you can download mine and look at the source code (Perl). Dec 5, 2020 at 10:58
  • @StephenOstermiller "Note that Google will stop supporting recaptcha v1 on March 31, 2018" could be updated ;o)
    – Steve
    Dec 7, 2020 at 5:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.