A dozen loan offers, casino links and a bot-generated message in a foreign language — that's the first symptom of spam in a contact form. The second symptom is worse and harder to spot: to fight it, someone turns on too aggressive a filter and throws away a real customer inquiry along with the spam, one that never gets an answer.
On this page: how reCAPTCHA v3 works without any puzzle for the visitor, why a low score shouldn't reject a submission outright, which form fields help humans instead of getting in their way, and how to check yourself whether a form actually delivers its submissions at all.
Two losses, not one
Spam in a contact form is the first, visible loss: the inbox fills up with messages that have to be reviewed and deleted. The second loss is more expensive precisely because it's invisible — it's a real customer's inquiry that the filter flagged as suspicious and that never reached anyone who could answer it. A business that loses real inquiries to an overly aggressive filter pays more than one that just deletes spam by hand every so often.
So the question isn't "how do I block all spam," it's "how do I filter out most of the spam without losing a single real inquiry in the process."
How reCAPTCHA v3 works: a score instead of a puzzle
Older versions of reCAPTCHA interrupted the visitor with a puzzle of distorted letters or clicking on traffic-light images. reCAPTCHA v3 works differently: it provides a score-based system to assess user interactions without interrupting their experience, and it's the site itself that decides what to do with that score. For the visitor filling out the form, it looks exactly the same as having no bot protection at all.
What to do with a low score
That's exactly where the key decision lives: reCAPTCHA v3 only hands you a number, not a verdict of "this is a bot" or "this is a human." A low score shouldn't automatically delete a submission — it should route it to a separate review queue, where someone glances once a day to check whether a real inquiry is hiding among the suspicious ones and might just be worth a phone call.
The rule for a low score: a queue, not a trash bin
Submissions with a low score go to a separate status or folder — not the trash, and not straight into the main inbox next to normal inquiries either. A short daily review of that queue costs a few minutes and protects against the day's only inquiry turning out to be "suspicious" just because the customer was typing from a phone with a weak signal.
Form fields that help humans, not bots
Choosing the right field type won't stop a bot, but it genuinely speeds up filling out the form for real people — and less frustration means fewer forms abandoned halfway through.
| Field | Attribute | Why |
|---|---|---|
| Phone | type="tel" | matching numeric keyboard on mobile |
| type="email" | keyboard with @ symbol and basic validation | |
| Phone number | one field, not several separate ones | the browser can autofill it |
| Required field | required | the browser checks before the form is even sent |
| Contact consent | checkbox with a clear description | clarity about exactly what the customer is agreeing to |
For a phone number, type="tel" means the user on a mobile device gets an adapted on-screen keyboard and types the number faster; the same applies to type="email" for an email address.
One field for the phone number
Numbers such as a phone number or a card number are best entered into a single field, instead of being split across several separate boxes for area code, prefix and the rest of the digits — that way the browser can offer autofill for the whole number at once, instead of forcing the customer to retype it from memory or from another window. It's a small thing, but small things like this are exactly what decides whether someone finishes filling out a form on their phone on the bus.
The minimum number of fields
Every extra field is one more reason to abandon the form halfway — especially on mobile, where each field is a separate tap. Before adding another field "just in case," ask whether you really need that information before you've even answered the customer's first inquiry, or whether it can wait for a phone call. A similar problem — too much distance between the form and the answer — comes up in query handling automation: one queue instead of five inboxes helps here just as much as it does for inquiries themselves.
Which field can really wait for the call
Address, business registration number, preferred contact time — all of it sounds useful, but it's rarely needed at the moment of the first submission. If a field only exists so you don't have to ask about it later on the phone, it's worth asking whether that one extra phone call really costs more than a dozen abandoned forms a month. In practice, two or three fields are enough: a way to reach the person, a short description of the matter, and consent to contact — everything else can wait for the first conversation.
The delivery test: one test submission a week
A form that technically works but doesn't deliver submissions to the right person is worse than a form with no spam protection at all — because no one knows anything is wrong until a customer calls asking why nobody answered. A simple habit is one test submission a week, sent from a phone, the same way a customer would.
What to track in the test
A weekly test over a year comes out to 1 × 52 = 52 tests a year — consistency matters more than the count. With every test, it's worth noting two things: whether the message arrived at all, and how many minutes it took. If the answer to either question starts getting worse, that's the signal to check the form's settings before an annoyed customer does it for you.
Alternative entry points next to the form
Not every customer wants to fill out a form — some would rather just call or message on a messaging app, and the form shouldn't be the only way to get in touch. A phone link in the site's code is a simple <a href="tel:...">, and that tel: URL scheme launches the Phone app directly on the customer's device, without copying the number to the clipboard. A phone button and a messenger icon next to the form cost one line of code and give the customer a choice instead of forcing them down a single path.
Do it yourself
The list below is the order worth following so you don't break anything that's already working.
- Turn on reCAPTCHA v3 and check what scores real submissions actually get.
- Set up a separate queue for low-score submissions — not the trash.
- Change the phone and email field types to
telandemail. - Merge a split phone number field into one.
- Send a test submission from your phone this week and note the result.
What it looks like when a system filters submissions
- 01Form submission
- →02reCAPTCHA score
- →03CRM or review queue
- →04human review
This isn't a promise of "zero spam" — no filter can guarantee that — just a way for spam to land in a separate queue instead of the main inbox, while a real inquiry never gets lost along the way. Aura connects the pieces like this: Lead forms build a form with a minimal number of fields and the right data types, CRM and automations route normal submissions straight to one place while suspicious ones go to a review queue. If the form sits on a page that doesn't collect many inquiries in the first place, UX and conversion checks whether the problem actually lies somewhere other than the spam filter, and Integrations connect the form to the rest of your systems without manual re-entry. A monthly report from Analytics and BI shows how many inquiries actually arrive and what each one costs. If you're building a site from scratch, the same form can be built right alongside it, as part of Websites and stores. Related reading: errors when implementing automation and what can realistically be handed to a system, and what can't — a form filter is exactly the kind of case where automation only helps as long as someone is still watching the queue.
If your business doesn't yet have a habit of counting lost contacts at all, a similar problem comes up with missed calls — there too, the loss is silent and no one notices until someone starts counting.
Frequently asked questions
Does reCAPTCHA v3 show the visitor any task to complete?
No, that's its main difference from older versions — reCAPTCHA v3 runs in the background and returns a score without interrupting the form with any puzzle or image-clicking task.
What should happen if reCAPTCHA gives a real customer a low score?
A low score shouldn't automatically reject the submission. Instead it goes to a separate queue for human review — a short daily check of that queue protects against losing a real inquiry.
Is it worth reducing the number of fields in a contact form?
Yes — every extra field is one more reason to abandon the form, especially on mobile. It's worth keeping only what you genuinely need before you've even answered the customer's first inquiry.
Why should a phone number be one field instead of several?
Because then the browser can offer to autofill the whole number at once, instead of forcing the customer to manually retype it piece by piece into separate boxes for the area code and the rest of the digits.
How do I check whether a form on a site is actually delivering submissions?
The simplest way is to send a test submission from your phone once a week, the same way a customer would, and note whether it arrived and how many minutes it took — if either starts getting worse, that's a signal to check the settings.
Should a form be the only way to get in touch on a site?
No — a tel: phone link and a messenger button next to the form give the customer a choice, and some people would rather just call than fill out any form at all.