Contact form spam statistics 2026.

In splitforms' 2026 dataset of 993 contact forms, 23.1% of stored submissions were spam, yet the median busy form saw only 1.4%, according to the splitforms Contact Form Statistics 2026 report. That gap is the number this page starts from: the pooled spam share is 16.5 times what the typical form experiences, because a small group of heavily targeted forms absorbs most of the junk.

If you run a contact form, you've seen both worlds. Some weeks the inbox is quiet; then one form starts collecting dozens of link-stuffed messages a day and real leads get buried under them. The obvious fix is a CAPTCHA, and the obvious source of numbers is a "contact form spam statistics" roundup. Both disappoint. Bots now beat humans at most CAPTCHA types, and no organisation publishes an aggregate, independent dataset of contact form spam. The roundups recycle vendor claims without a method.

So this page does the honest version. We collected every primary number we could verify, labelled single-site and vendor data as exactly that, and set out the study we're running to fill the gap.

Contact form spam statistics at a glance

How much spam does a typical contact form get?

A typical contact form gets far less spam than the headline rates suggest: in splitforms' 2026 data the median form with 20 or more submissions had a 1.4% spam share, while the pooled share across all forms was 23.1%.

The splitforms report is the only published dataset we found that measures spam across many contact forms with a stated method. It's vendor data from a form backend whose customers skew towards developers, small businesses and static sites, so treat it as one well-documented sample, not a census.

We'd read the 23.1% as "how much spam reaches the content filter", and the 1.4% as "what most site owners live with". Both are true at the same time. Spam on forms behaves like a lightning strike, not like rain: most forms stay dry, a few get hit over and over, and those few skew every average you'll see quoted.

The concentration matters for how you protect a form, which is where the content of the spam comes in.

What does contact form spam look like?

Contact form spam is mostly links: 81.0% of the submissions splitforms quarantined between 14 August and 30 September 2026 contained links or suspicious URLs, and spam messages ran about six times longer than real ones.

The 2.0% for disposable addresses surprised us less than it might surprise you. Form spammers want a reply, or at least a click, so they use real-looking addresses and pack the message with URLs. Blocking throwaway domains is cheap, but on this data it catches about one spam message in fifty. Checking for links catches forty in fifty.

Content filters work on what the bot sends. The next question is how many of the visitors hitting your form are bots in the first place.

How much of the traffic reaching web forms is automated?

Automated traffic made up more than 53% of all web traffic in 2025, up from 51% a year earlier, according to Imperva's 2026 Bad Bot Report. Not every bot fills in forms, but every form sits on a web where humans are now the minority.

Our bot traffic statistics break the 53% down by bot type and year. For forms, the 27% API figure is the one we watch: a bot that posts directly to your form endpoint never loads the page, so any check that lives only in the page's JavaScript never runs.

Project Honey Pot's weekly counts tell a story the totals hide. Harvesters, the bots that scrape addresses off pages, still outnumber active comment spammers in its network by about 95 to 1 in a single week. Scraping is cheap and silent. Posting spam is the noisier second step.

The vendor counters below show the scale from the defender's side.

How much spam do anti-spam services say they block?

Akismet's public counter shows more than 574 billion pieces of spam blocked as of November 2026, across comments, forms and other text. These are vendor totals: useful for scale, impossible to audit, and never a spam rate for your form.

We'd never cite a vendor counter as a rate, and we'd ask you not to either. 574 billion tells you the problem is industrial. It says nothing about whether your form gets 2 spam messages a month or 200 a day, and that is the number you need.

Where that traffic comes from is the next thing vendors publish.

Where does form and comment spam come from?

The United States is the largest source of spam traffic in CleanTalk's December 2025 to October 2026 data at 32.61%, followed by the Netherlands at 11.84%. Country of origin here means the IP address the request came from, which is often a hosting provider or VPN, not where the spammer lives.

The Netherlands in second place is a data-centre signal, not a national one. Large hosting regions show up in every spam table because that's where rented servers sit. Geo-blocking a whole country to stop form spam usually locks out real customers and barely dents the bots.

Geography doesn't stop bots. The usual answer is a CAPTCHA, and that's where the best independent research is.

Do CAPTCHAs still stop contact form spam?

CAPTCHAs no longer separate bots from humans reliably: published bot attacks solve modern CAPTCHAs with 85 to 100% accuracy, mostly above 96%, while humans in the UC Irvine 2023 study scored 50 to 85%. The study, published at USENIX Security in August 2023, is DATED by our 24-month rule and is still the most complete comparison available.

The UC San Diego pricing data is from 2010 and clearly DATED. We include it because nobody has published a peer-reviewed price study since, and because its conclusion still holds: once humans can be hired to solve a CAPTCHA for a tenth of a cent, the CAPTCHA stops being a security barrier and becomes a small tax.

This is the part of the data that changed how we build. A puzzle that a bot solves more accurately than your customer is a filter for customers. We'd rather check what the browser does (how fast the form was filled, whether a hidden field was touched) than ask a person to prove something a machine now proves better.

The cost of that tax falls on people, which the next section measures.

How much time and how many visitors do CAPTCHAs cost?

A reCAPTCHA image challenge took humans 22 seconds when it appeared inside a realistic task such as account creation, according to the UC Irvine 2023 study. Across 1,000 genuine contact form submissions, that's 6.1 hours of your visitors' time.

All Cloudflare figures here are vendor data from 2021 and 2023, so DATED, and the 500-year figure is Cloudflare's own back-of-the-envelope estimate. The UC Irvine abandonment range comes from paid participants, who have more reason to finish than a visitor with a question about your pricing.

We think the abandonment numbers are the real cost, and they're the hardest to see. A spam message you can delete. A lead who closes the tab at the puzzle never shows up in any log. If 15% of people give up at a CAPTCHA, a form that gets 100 genuine attempts a month could be losing around 15 of them.

Some of that spam starts long before the form, with the address printed next to it.

How do spammers find the email address on a contact page?

Spammers find most addresses by scraping web pages: in the Center for Democracy & Technology's 2003 test, over 97% of all spam received went to addresses that had been posted on the public Web. Both studies in this section are more than 20 years old, so they're DATED, and they remain the only controlled experiments of their kind we could verify.

That last result is why we built Email Protector: if the address isn't in the page's HTML, a harvester that reads the HTML finds nothing. Harvesters have improved since 2003 and HTML entities alone now only stop the laziest ones, which is why the free snippet tool defaults to a JavaScript method. For the downstream effect on inboxes, see our spam email statistics.

The 2003 result that obscured addresses got zero spam won't repeat exactly today; some scrapers now run a full browser. What still holds is the shape of the curve. Publishing a plain address on a busy page is the single biggest spam decision a site owner makes, and it's the one that costs nothing to undo.

Forms bring a second risk that addresses don't: they can be turned into a spam cannon pointed at other people.

What happens when bots abuse a contact form?

Bots can turn a contact form into an outbound spam relay: in one Sucuri case from October 2025, a "send a copy to yourself" checkbox let bots queue 149,700 emails across several websites on one hosting account.

This is a single-site case study, not a rate. We include it because it shows a failure mode most spam statistics ignore: the damage lands on the site's mail reputation, not only on its inbox. Our WordPress security statistics cover the wider plugin risk.

If your form emails a copy to whatever address the visitor typed, a bot can make you send its spam for it. We'd remove that checkbox before adding any CAPTCHA.

The scale of the forms involved explains why one bad default can hurt so many sites.

How many websites rely on contact form and anti-spam plugins?

Contact Form 7 alone is active on more than 10 million WordPress sites, according to WordPress.org's plugin directory in November 2026. Every one of those forms is a possible spam target, and most rely on a plugin for protection.

WordPress.org rounds these numbers into bands, so treat them as floors. They also count only WordPress; forms on hosted builders and static sites sit outside them.

The install counts say something the spam counters don't: the people defending these forms are mostly small site owners with a default plugin. Whatever protection ships enabled by default is the protection most forms have.

That leaves the question this page was built around.

Why is there no public dataset on contact form spam?

No independent organisation publishes aggregate contact form spam statistics; the numbers that exist come from vendors who see only their own customers, from single-site case studies, or from research on CAPTCHAs and harvesting rather than on forms.

There are three reasons we can see. Form spam is usually discarded before anyone counts it: splitforms notes that honeypot and time-trap catches are dropped before storage. Each vendor sees a different, self-selected slice of the web, so their rates aren't comparable. And spam on forms is so concentrated that a sample of a few hundred forms can swing on a handful of targeted ones.

We think the gap is the most useful finding on this page. Anyone quoting "X% of contact form submissions are spam" as an industry figure is quoting one vendor's customers. Until someone publishes a method and raw counts, the honest answer is a range and a caveat.

So we're running the study ourselves.

Our own study (in progress)

We are running a contact form spam study across several test sites, and we have no results yet. Nothing in this section is a finding; it's the method, published in advance so you can hold us to it.

1. Setup. We'll place identical contact forms on several test sites that differ in age, traffic and topic, each with no CAPTCHA and an invisible honeypot field.
2. What we log. Every submission, with time from page load to submit, whether the honeypot was filled, whether the request came through the page or straight to the endpoint, country by IP, and the message's links and length. We won't store message content longer than the classification needs.
3. Classification. Each submission gets labelled spam or human, using the honeypot and timing first, then a manual review of anything ambiguous.
4. Duration. 60 to 90 days of collection.
5. What we'll publish. Spam share per site, the bot versus human split, time-to-submit distributions for each, the country split, and how much spam each invisible check alone would have caught.

Results will be added to this page when the collection window closes, with the raw counts.

How we calculated the original numbers

Three figures on this page don't appear in any source. Here is the arithmetic.

1. 16.5x: pooled spam share vs the median form. splitforms reports a pooled spam share of 23.1% across 21,050 submissions to 993 forms, and a median of 1.4% among the 183 forms with 20 or more submissions. 23.1 / 1.4 = 16.5. Both inputs come from the same dataset and window, so the ratio measures concentration, not a difference between populations.
2. 6.1 hours of human time per 1,000 genuine submissions. UC Irvine measured 22 seconds for a reCAPTCHA image challenge in a contextual task. 22 seconds x 1,000 submissions = 22,000 seconds, or 6.1 hours. This assumes every genuine visitor sees one image challenge; forms where most visitors pass the checkbox alone cost far less.
3. About 90% less spam after removing a published address. CDT reported 2 or 3 spam messages a day for addresses removed from the Web against 30 or more for addresses left online. (30 - 3) / 30 = 90%. Both inputs are from 2003, and "30 or more" makes this a conservative estimate.

The CleanTalk top-10 share (73.29%) is a simple sum of the ten country shares CleanTalk publishes, and the 95-to-1 harvester ratio is Project Honey Pot's 2,080 active harvesters divided by its 22 active comment spammers in one week, so we don't count either as an original.

What do the 2026 numbers say?

Contact form spam is concentrated, not universal. A 23.1% pooled rate and a 1.4% median from the same 993 forms mean most site owners have a small problem and a few have a large one. Any single "average spam rate" hides that, and any protection should be judged on the forms that get hit.

The CAPTCHA has flipped. Bots match or beat humans on accuracy and speed for most CAPTCHA types, human solving was already a tenth of a cent per puzzle in 2010, and real people give up at the puzzle. A defence that costs your visitors more than it costs the attacker is upside down.

The quiet checks win. Links in 81% of spam, a published address that draws 97% of address-based spam, a send-a-copy checkbox that made 149,700 emails: each points to a check the visitor never sees. That's the direction we're building in, and our study will tell us how far it gets.

FAQ

What percentage of contact form submissions are spam?

23.1% of stored submissions to 993 forms were spam in splitforms' July to September 2026 data, and that's a floor because honeypot catches weren't stored. The median busy form saw just 1.4%. No independent, cross-vendor figure exists.

Do CAPTCHAs stop contact form spam?

85 to 100% is the accuracy published bot attacks reach on modern CAPTCHAs, against 50 to 85% for humans, according to the UC Irvine study at USENIX Security 2023. CAPTCHAs still slow down the cheapest bots, but they no longer separate bots from people reliably.

How long does a CAPTCHA take a real visitor?

22 seconds for a reCAPTCHA image challenge inside a realistic task, according to UC Irvine (2023); Cloudflare measured 32 seconds on average in 2021. Across 1,000 genuine submissions, 22 seconds each adds up to 6.1 hours of visitor time.

Does hiding my email address reduce spam?

97% of the spam in the Center for Democracy & Technology's 2003 test went to addresses posted in plain text on the Web, and obscured addresses got none. The study is old and scrapers have improved, so JavaScript-based hiding is safer today than HTML entities.

Where does contact form spam come from?

32.61% of the spam traffic CleanTalk saw from December 2025 to October 2026 came from US IP addresses and 11.84% from the Netherlands. Those are mostly hosting and VPN locations, so they say where servers sit, not where spammers live.

Why do bots fill in contact forms?

81.0% of the form spam splitforms quarantined in 2026 contained links, so most bots want a click or a backlink. Some also abuse forms to send email: Sucuri documented 149,700 spam emails sent through one copy-to-sender feature in 2025.

Sources

1. splitforms, Contact Form Statistics 2026: Spam, Fields & Timing from 993 Forms (October 2026)
2. Imperva (Thales), Bad Bot Report 2026: Bots in the Agentic Age (April 2026)
3. Imperva, 2025 Bad Bot Report (2025)
4. Akismet, homepage counters (read November 2026)
5. CleanTalk, Spam Statistics (December 2025 to October 2026)
6. Project Honey Pot, Project Statistics (read November 2026)
7. Searles et al., UC Irvine, An Empirical Study & Evaluation of Modern CAPTCHAs, USENIX Security 2023 (August 2023)
8. Motoyama et al., UC San Diego, Re: CAPTCHAs, Understanding CAPTCHA-Solving Services in an Economic Context, USENIX Security 2010 (August 2010)
9. Cloudflare, Humanity wastes about 500 years per day on CAPTCHAs (May 2021)
10. Cloudflare, Turnstile is generally available (September 2023)
11. Google, reCAPTCHA v3 documentation (read November 2026)
12. US Federal Trade Commission, Federal, State, and Local Law Enforcers Tackle Deceptive Spam and Internet Scams (November 2002)
13. Center for Democracy & Technology, Why Am I Getting All This Spam? (March 2003, archived copy; the original cdt.org link no longer resolves)
14. Sucuri, Contact Form Spam Attack: An Innocent Feature Caused a Massive Problem (October 2025)
15. WordPress.org, Contact Form 7 (read November 2026)
16. WordPress.org, WPForms Lite (read November 2026)
17. WordPress.org, Akismet Anti-spam (read November 2026)

Methodology. Numbers were collected in November 2026 and checked against the original publisher's page, report or paper, not against statistics roundups. Vendor data (splitforms, Akismet, CleanTalk, Cloudflare, Imperva) and single-site case studies (Sucuri) are labelled as such in the text. Figures older than 24 months are marked DATED where they appear. Vendor claims with no stated method appear only as scale indicators, never as rates. Our own contact form study is in progress and no results are reported yet. Last updated 14 November 2026.