The 3 AM spam flood
Four hundred "enquiries" overnight, all gibberish, all links, none human. Your inbox is useless, real leads are buried, and the temptation is to close the form. This is the fix sequence from the spam rescue page, written as a guide.
Why your forms get hit
Bots crawl for form endpoints and submit at machine speed. Popular platforms (WordPress especially) are targeted by keyword-searching bots. Once your form URL is on a spam list, floods repeat. The fix is layering: no single wall stops them all, three cheap layers stop practically all.
The layered fix
- Layer 1, honeypot: a hidden field humans never see. Bots fill it; the server silently discards. Stops the dumbest half, zero user friction.
- Layer 2, time-trap: the form records when it loaded. Submissions under three seconds are bots. Free, invisible, effective.
- Layer 3, rate limiting: per-IP and per-session submission caps. A flood becomes a trickle before it reaches your inbox.
- Layer 4, filtering: server-side keyword and link-pattern rejection, logged so false positives can be checked.
- Layer 5, verification where justified: invisible challenges on high-traffic forms. CAPTCHA last: it taxes real users, and conversions pay that tax.
- Layer 6, the store: submissions land in a permanent store so real leads among the flood are never lost, and spam is deletable in bulk. See the routing guide.
Implementation costs and effort
Layers 1, 2 and 4 on an existing site: ₹11,000 – ₹34,000 from a senior, often a same-week fix. Layer 3 depends on hosting access. Layer 6 is the lead-store pattern which should exist anyway: see the lost-leads audit to check whether your forms even store what they receive.
Signs the flood is not bots
Occasionally the "spam" is a competitor's doing, or a misconfigured integration looping submissions, or a real (annoying) human. The fix sequence still works, but the logging layer matters more: know what you are blocking before you celebrate blocking it.
Prevention after the fix
The layered fix holds; floods return at lower intensity and die silently. This is standard maintenance scope: reviewed monthly, tuned when patterns change. Sites without maintenance rediscover the flood quarterly; sites with it forget the flood happened.