Fake form submissions: what they cost and how to stop them.

If you run a Norfolk business with a contact form, chances are you've opened an enquiry only to find a garbled message about cryptocurrency, a link farm pitch, or a completely blank submission. Spam form submissions waste your time, clog your inbox, and worst of all, they cost you money if you're paying per lead or per click through Google Ads.

UK SMEs lose an estimated £6,000 per year chasing fake leads and dealing with spam, yet most business owners assume it's just part of having a website. It isn't. With the right combination of invisible filters and sensible friction, you can block 95% of junk without making life harder for real customers in Norwich, King's Lynn or Great Yarmouth.

Why your Norfolk business form attracts spam in the first place

Bots scrape the web looking for any page with a <form> tag. If your contact form is visible and has no protection, automated scripts will fill it in hundreds of times a day. Some spam is commercial (SEO agencies in Mumbai offering to rank you first on Google), some is malicious (phishing links), and some is just noise generated by bots testing vulnerabilities.

The moment your site appears in Google's index, the bots arrive. A brand new website for a Norwich café can receive its first spam submission within 48 hours of going live.

A brand new Norfolk business website can receive spam within 48 hours of launch.

The wrong way to stop spam (and why it kills real enquiries)

Many developers reach for Google reCAPTCHA v2, the one with the "I'm not a robot" tickbox and the grainy photos of traffic lights. It works, but the cost is high. Studies show that visible CAPTCHAs reduce form completions by 30% or more, because real customers on mobile find them fiddly, slow, and frustrating.

Even worse: requiring someone to solve a puzzle before they can ask you a question signals that you don't trust them. That's not the first impression a Norwich business wants to make.

The right way: invisible filters that let real customers through

Modern spam protection works in the background. Your customer fills in the form, hits send, and never knows a filter is running. Here's what actually works for Norfolk small businesses in 2026:

1. Honeypot fields

Add a hidden field to your form that's invisible to humans but visible to bots. Real people can't fill it in because they can't see it. Bots fill in every field they find. Any submission with the honeypot filled gets silently binned. Simple, free, and effective against 60–70% of spam.

2. Google reCAPTCHA v3

Unlike v2, version 3 runs invisibly in the background and gives every visitor a score from 0.0 (definitely a bot) to 1.0 (definitely human). You set a threshold, usually 0.5, and anything below that gets blocked or flagged for review. No clicking, no photos of buses, no friction for your Norwich customers.

3. Time-based submission checks

Bots fill in forms in milliseconds. Humans take at least a few seconds to read the labels and type. Reject any submission that arrives in under three seconds. This catches automated scripts that don't simulate realistic behaviour.

4. Block disposable email domains

Maintain a blocklist of temporary email providers (mailinator, guerrillamail, etc.). Real customers use real email addresses. Spammers use burner accounts. This won't stop all spam, but it filters out the laziest offenders.

When to add a little bit of visible friction

If you're still getting spam after invisible filters, add one small, human-friendly question at the end of your form. Not a CAPTCHA, just a simple question with an obvious answer:

• "What city are we based in?" (Answer: Norwich)
• "What's 4 + 5?" (Answer: 9)
• "Type the word 'customer' in the box below."

Bots can't parse natural language questions reliably. Humans can answer in half a second. It's a tiny bit of friction, but it stops almost everything that slips through the invisible layer.

What to do if spam still gets through

No filter is perfect. If you're still seeing a trickle of junk, don't panic. Set up a server-side keyword blocklist for common spam phrases ("SEO services", "cryptocurrency", "click here") and auto-reject anything that matches. Most modern form plugins and CRMs support this natively.

For higher-value forms (quote requests, survey bookings), consider a two-step process: the customer fills in basic details, then receives an email with a unique link to confirm their enquiry. Bots rarely follow up. Real customers do.

Why this matters for your Norfolk business

Every fake submission you open is time you're not spending on a real customer. If you're running Google Ads and paying per form fill, every spam lead is money down the drain. And if you're a one-person business in Norwich, you don't have the bandwidth to sift through 50 junk messages a week.

Invisible spam protection costs nothing to implement and saves hours every month. It's not glamorous, but it's one of the highest-ROI fixes you can make to a business website in 2026.