Every other door in your business has a lock on it. The office entrance, the file cabinet, the accounting software, the email accounts. Your contact form is the one door you deliberately prop open, with a sign beside it that says come on in. That is the point of it. A stranger you have never met should be able to type their name, describe their problem, and hit send.
That openness is also why the contact page is the most abused page on most small business websites. Some of what lands in your inbox is ordinary spam. Some is automated software checking what your form accepts. And some of the risk has nothing to do with attackers at all. It is the quiet question of where submissions go, who reads them, and how long they sit there. Here is how to handle all three without turning your page into an obstacle course.
The Spam Flood Is a Business Problem Before It Is a Security Problem
We get called about form spam more than almost any other website issue, and the complaint is rarely about security. It is about the sales team. When a shared inbox fills with junk, people stop reading it carefully. Then they stop reading it at all. A month later somebody finds a real quote request unanswered in the pile, from a customer who already hired someone else.
That is the real cost of form abuse for most small businesses. Not a breach. A missed lead, and staff quietly trained to ignore the one channel you built for new business. The security benefits of cleaning it up come along for the ride.
Not Every Submission Is a Customer, and Not Every Submission Is Spam
There is a third category owners often miss. Some submissions are neither customer nor marketing pitch. They are automated software submitting to your form to see how it behaves. You are not being singled out. Tools sweep across large numbers of sites and note which ones respond in an interesting way.
The OWASP Foundation, which publishes free application security guidance, catalogs this automated abuse of public forms, including fake account creation, scraping of submitted data, and enumeration. Its Bot Management and Anti-Automation guidance notes that such attacks pollute data quality and undermine user trust.
You do not need to analyze anything to recognize the shape of it. Look for submissions arriving in bursts at odd hours, messages nearly identical to each other, name fields filled with text no person would write, and message bodies made up mostly of links. That is automation, not a market segment you have failed to understand.
Where Do Your Form Submissions Actually Go?
Ask that out loud in a meeting and watch the room go quiet. On a typical WordPress site, one submission usually creates three copies of the same information: an email notification, a stored entry in the website database, and often a record pushed into a customer relationship tool or marketing platform.
Each copy has its own audience. Anyone with administrator access to the site can read every stored entry going back years. Anyone with the shared inbox reads the notifications. The marketing platform has its own user list, which may still include a contractor you stopped working with years ago. Most owners have never seen that list in one place, the sort of gap we describe in our piece on shadow IT and the risk inside your own organization.
The Federal Trade Commission puts the principle plainly in its Start with Security guide for business: “No one can steal what you don’t have.” A form that has archived every submission since launch holds names, phone numbers, and whatever else people volunteered, for no business reason anyone can name.
Notifications Carry Real Information in Plain Email
Form notifications tend to contain everything the person typed. That is convenient. It is also how customer detail ends up scattered across personal phones, forwarded threads, and the inbox of an employee who left last spring. People put things in a free text box they would never type into a labeled field, including account numbers, health details, and passwords they want reset.
There is a second angle. Notification emails have a predictable shape, appear to come from your own domain, and get clicked without thinking. That is attractive to anyone building a convincing lure, which connects to our article on why phishing keeps getting through. A safer pattern is a short notice that a submission arrived, with the recipient signing in to read it.
The Defenses That Actually Work
None of this requires an expensive product. It requires a handful of settings applied together. OWASP is direct about why the combination matters, stating that “A single control is brittle” and recommending controls at the edge, in the application, and in the business logic.
- Ask for less. Every field you remove cannot be filled with junk, stored, or leaked. Name, email, and a message box serve most businesses. If you never act on the fax number, stop collecting the fax number.
- Validate on the server, not just in the browser. OWASP’s Input Validation guidance is explicit that validation “must be implemented on the server-side before any data is processed,” because checks running only in the visitor’s browser can be bypassed. It also recommends defining allowed characters and a minimum and maximum length rather than blocklisting bad ones.
- Use modern spam filtering instead of a puzzle. OWASP describes traditional CAPTCHAs as “accessibility-hostile, machine-solvable by ML, and outsourced to human solver farms,” and points instead to invisible risk scoring services. It also advises offering an accessible alternative when you do challenge someone, and preferring a challenge over an outright block.
- Add a hidden field trap. A field hidden from human visitors but visible to automated tools costs nothing and catches a meaningful share of low-effort submissions. OWASP lists it as a standard low-friction control.
- Rate limit the form. OWASP recommends separate limits per network address, per identity, and per page, so one source cannot submit hundreds of times a minute. Your host, your security plugin, or a service sitting in front of your site can apply this.
- Turn off file uploads unless you truly need them. If you do, OWASP recommends restricting to an expected list of file types and enforcing a maximum file size. An open upload box on a public page is a different level of exposure.
- Put stored entries on a delete schedule. Decide how long a submission needs to live in the website database, then set the form tool to purge older ones automatically. Your customer relationship system, not your website, is the long-term home for a real lead.
Finally, treat the form as software that needs maintenance. Form plugins, spam filters, and the platform underneath them all get updates, and a form tool nobody has touched in two years runs on expired assumptions. Updates belong on a recurring schedule with the rest of your website care, not on the day something breaks. That habit is part of the argument in our post on why cybersecurity is no longer optional for mid-sized businesses.
The Bottom Line
Your contact form is supposed to be open. The goal is not to lock it. The goal is to make it boring for automated tools and reliable for real customers. Collect fewer fields, validate on the server, use current spam filtering instead of a puzzle nobody wants to solve, limit how often the form can be used, and know where every copy lands. Then decide how long you keep it. Your inbox becomes trustworthy again, and the pile of customer information on your website shrinks to something you can defend.
If your contact form has become a nuisance instead of a lead source, or you do not know where submissions are stored and who reads them, we can sort it out. Harrison Ward Technology works with businesses across Denton County on website maintenance, email security, and the cleanup that keeps both working. Contact us today
Sources:
Comments are closed