Walkthrough · Beginner · 30 minutes
How to Protect Forms From Spam
Shut down the bot deluge without forcing genuine customers to prove their humanity — a hands-on walkthrough in plain words that names the classic mistake before you reach it.
The short answer
The job: shut down the bot deluge without forcing genuine customers to prove their humanity. Time to set aside: 30 minutes. Skill needed: beginner.
Below are the precise steps, the classic stumble, and one tip from the support desk. Wherever the platform already does a step for you, the guide says so rather than handing you a machine's chores.
By the Hosting & Domains team · Reviewed 18 August 2026
Beginner
Skill rating
30 minutes
Time budget
5
Steps in total
24/7
Support on call
No prior knowledge assumed — a hosting account, a browser and 30 minutes of attention is the whole entry requirement. Every instruction runs on our platform exactly as printed, and carries over to any standard cPanel host.
First rule: read the snag section before you start, not afterwards. It was distilled from the tickets of everyone who tried the other order.
The outline first, then the detail
Over the whole job, you will start with a honeypot, time how fast the form is completed, add a modern captcha only under pressure, filter the classic spam content and store every submission as well as emailing it.
No part of this needs code or a terminal unless the guide says so plainly — and where it does, the exact commands are printed. The step-by-step is below, with the surrounding sections supplying the context that makes it hold.
The error nearly everyone hits
Leading with a hard visible CAPTCHA. At the margins the puzzle turns away measurably more people than bots, trading real enquiries for spam a honeypot would have absorbed invisibly.
Forewarned is genuinely forearmed here. This one mistake accounts for most of the frustration the topic ever causes — and it disappears entirely once somebody points it out.
A habit worth borrowing
Never put a raw mailto: address anywhere public. Scrapers collect it within days, and that inbox then holds a spam subscription for the rest of its life. The public contact surface is precisely where a protected form belongs.
Habits this small are what separate the people who find hosting effortless from the people who find it draining. The same tools on both sides — a different way of working.
The steps already done before you arrive
Steps that never deserved your time are taken out: certificates issue and reissue themselves, the installer handles application setup, the daily copy absorbs the what-ifs, and per-site settings live in a panel rather than a configuration file. The guide covers the remainder — the part that is actually about your site.
Should a step still misfire, support answers at any hour with an actual fix rather than a knowledge-base link and a shrug. Half the guides on this site began as repeat patterns in our ticket queue.
Why this job is shorter on our plans
Every walkthrough in this library is run on the platform we actually operate — cPanel, LiteSpeed, NVMe, one-click installs — so the instructions match your screen rather than gesturing at it from a distance.
A free SSL certificate comes with every plan and reissues itself before the old one lapses — the padlock is never yours to diarise.
- Every step checked exactly as published
- The snag named before it arrives
- The dull steps taken out of your way
- People reachable at any hour you stall
Why Hosting & Domains
Standard on every plan
The snag, flagged up front
The classic error for this particular task is named before step one, which is how 30 minutes stays 30 minutes.
Honest about how big it is
Shut down the bot deluge without forcing genuine customers to prove their humanity is a beginner-level job — set aside 30 minutes, with the platform-absorbed steps marked.
Help that keeps your hours, not ours
Stuck on step three at midnight? Support answers at any hour, mid-walkthrough included.
5 steps, nothing padded
Each stage is a few minutes of steady clicking, and the fiddly moments are labelled fiddly.
Works exactly as printed
Every step is proven on the platform we run — none of the 'your host may vary' hedging.
Every undo written out
Any step that could bite is marked, together with the exact way to wind it back.
Quick Start
Order placed to site online
- 1
Start with a honeypot
A hidden field no person will ever fill in. Bots complete every input they meet and give themselves away at no cost to real visitors. In most form plugins it is one toggle.
- 2
Time how fast the form is completed
A form finished in two seconds was filled in by a script. A minimum-duration check catches the paste-and-blast bots that walk straight past the honeypot.
- 3
Add a modern CAPTCHA only under pressure
Invisible reCAPTCHA or Turnstile scores behaviour without setting a puzzle. Save visible challenges for forms under genuine siege, because every puzzle costs real enquiries.
- 4
Filter the classic spam content
A blocklist for the familiar signatures, link-stuffed messages and the evergreen keywords, mops up whatever gets past the behavioural layers.
- 5
Store every submission as well as emailing it
Form plugins that keep entries give you an audit trail. With submissions saved, even aggressive filtering can never quietly cost you a genuine lead.
Built In
Fitted to every plan
- Webmail in the browser plus IMAP, POP and SMTP for any client
- DDoS filtering absorbed at the network edge
- Your existing site brought across by our engineers, at no charge
- People on the support desk every hour of every day
- 99.9% uptime as the target, watched around the clock
- Upgrades applied in place, with no migration when you change plan
- cPanel, which is what most of the industry already runs
- WebP image optimisation built in, at no extra charge
- A renewal figure identical to the one you registered at
- WordPress Toolkit, with the updates seen to for you
Frequently Asked
The questions that come up most
Could these defences block genuine customers?
Stacked invisible checks, honeypot, timing and scoring, essentially never do. The hazard lies in harsh content filters and visible puzzles. Stored entries are the backstop, since even a wrongly rejected enquiry waits safely in the database to be found.
My form went from no spam to hundreds overnight — what changed?
Its address reached a target list. That is traffic rather than a breach. Stack the protections above and the flood drops to a trickle within days, as the list operators drift towards easier targets.
Will the renewal cost more than the first term?
No. The rate you order at is the rate you renew at, year after year. There is no introductory teaser here, so no second-year jump is waiting — the hosting line stays a fixed figure your accounts can plan around.
Can I choose the PHP version myself?
Yes — PHP is set per site from the control panel, so a legacy application and a current one can run side by side in one account. Extensions and per-site tuning are on the same screen, and none of it goes near a support ticket.
Keep reading
How to Set Up DKIM Signing
Cryptographically sign outgoing mail so spoofing and tampering both surface — intermediate level, about 10 minutes.
How to Publish a DMARC Policy
Instruct receiving servers on how to treat mail that flunks your authentication — intermediate level, about 15 minutes plus a monitoring month.
Spam Filter (Glossary)
The plain-English definition this page rests on, with a worked example.
Web Hosting
cPanel hosting on NVMe drives — SSL, the migration and year one of the name all included.
WHMCS License
Automate billing, provisioning and support for hosting clients of your own.
Changing hosts? Run through our checklist first.
A plain order of work for a move nobody visiting will notice: which files go over first, how to carry the mail across without losing a message, when exactly to repoint DNS, and the two mistakes behind nearly every outage we are asked to rescue.
Your site has earned better hosting.
From a first website to a rack of machines, moving up is a change to the account rather than a migration.
View Web Hosting plans