6 Ways to Prevent Spam Submissions (According to Experts)

Spam submissions are entries to online forms, usually from automated bots and human spammers, that clog your pipeline with false, irrelevant, or potentially harmful information. Here’s how to fight back.

You launch a paid campaign promoting a new product or service. And you see amazing results — thousands of leads and counting (or so it seems).

As you dive into the analytics, you find a large portion of the forms contain false information, gibberish, and suspicious links.

But don’t let this discourage you.

There are ways to prevent spam submissions before it hurts your data integrity and decision-making. Let’s explore how, with help from Ian Dawson, Lead Strategist at HawkSEM and digital marketer with plenty of spam-fighting experience.

What are spam submissions?

Spam submissions are unwanted, often automated entries to online forms with malicious intent.

They come from automated bots and human spammers, flooding your forms with false, irrelevant, or potentially harmful information.

Spam submissions typically happen in two ways:

1. Automated spambots: Programs that scour the internet for web forms and automatically fill them out. Spambots can submit hundreds or thousands of form entries in hours, overwhelming your system with junk data.
2. Manual Spamming: Uses people to fill out forms with false information or malicious links. It’s less common than bot-driven spam, but can be more difficult to detect and prevent.

The goals of spam submissions:

• Spread malware or phishing links
• Steal personal information
• Place invisible links for SEO manipulation
• Hijack website control
• Promote products or services
• Building backlinks to boost search engine rankings

“Spam submissions via form completion often have names that don’t match their email addresses, like John Smith at [email protected],” explains Dawson.

“Some are outright alphabet soup or keyboard mashing, which are easier to identify.”

If you’re seeing spam submissions in your database, then it’s time to do something about it. Continue reading to learn why.

Why is it important to prevent spam submissions?

Spam submissions are annoying at best and dangerous at worst. Most think they’re a problem you can overlook because some are obvious to spot and easy to ignore.

But what about those containing links leading to malware, spyware, and other malevolent software?

These can seriously damage your database and brand reputation, especially if it leads to a breach.

Here’s an overview of the consequences of spam submissions:

Compromised data quality

Your analytics and lead generation data are no longer trustworthy thanks to inaccurate website performance and marketing metrics. All those false form submissions count as visits and “quality leads” and shouldn’t be.

Wasted time and resources

No sales or marketing team wants to spend hours sifting through and deleting spam submissions. They’d rather focus on legitimate inquiries.

Poor user experience

Leaving spam comments and reviews unmoderated frustrates visitors, potentially drives them away from your site, and reduces engagement.

Decreased website performance

High volumes of spam submissions can slow your website for real users and potentially hurt business opportunities.

Increased security risks

Spam links may lead to phishing attempts, malware, and other malicious attacks. If a prospect is targeted through your site, you can forget about earning their business.

Damaged brand reputation

A website filled with spam content appears unprofessional and poorly maintained, eroding trust and potentially driving away customers.

Overwhelmed email systems

Spam emails will clutter your inbox, making it difficult to see important communications from real people.

Increased hosting costs

The strain on server resources from processing large volumes of spam may increase your hosting expenses or require a plan upgrade.

Inefficient lead management

Your sales and marketing teams waste time and effort on fake leads, reducing their ability to focus on qualified prospects and potentially missing out on real business opportunities.

Learning to deal with spam messages and junk solicitations isn’t how to save your business from these heartaches. Instead, focus on how to prevent spam submissions in the first place.

“Finding that balance can be challenging,” says Dawson. “Treating spam as an ongoing issue and not a one-and-done fix will help most businesses find that balance.”

He adds that understanding data points and aiming to reduce, not eliminate, spam will help to find that balance. Companies will miss out on valid lead submissions if the goal is elimination, like a brick-and-mortar store eliminating shoplifting by remaining closed.

Dawson recommends testing features like required fields and CAPTCHA.

“Review conversion times and determine if certain hours of the day are more likely to produce spam submissions,” he continues.” Even with automated bidding strategies, ad scheduling can limit ads from showing when spam is more likely to be submitted.”

How to prevent spam submissions: 6 ways that actually work

Thankfully, there are ways to stop spam submissions from crowding your database and website.

“We employ several tactics to help reduce spam submissions, including CAPTCHA, required fields, and search term research,” says Dawson.

“Making fields required to submit deters spammers and reduces spam submissions, while reviewing search terms can identify those more likely to result in a spam submission. These terms can be added as negative keywords.”

Next, let’s review the most commonly used methods for preventing spam submissions.

1. CAPTCHA
2. Google reCAPTCHA
3. Honeypot fields
4. Time-based restrictions
5. Multi-step forms
6. Email verification

1. CAPTCHA: The classic gatekeeper

Surely, you’ve seen these age-old security guards on web submission forms. They’re annoying to users, but helpful for businesses looking to keep out spam bots.

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge-response test to determine if the user is human.

These can reduce bot and automated spam by forcing the submitter to answer questions and complete visual puzzles,” explains Dawson.

“Some CAPTCHA interfaces also work via a “hidden” field that uses CAPTCHA technology while not disrupting genuine users’ experiences. We’ve found that implementing CAPTCHA can reduce spam submissions for Search Network efforts.”

Why is this important?

“Display Network efforts can be more difficult, as spammers can earn money from traffic via a Display Network banner ad,” continues Dawson.

“A spammer will create a site that hosts Display Network banners, clicks on them to gain ad revenue, and completes conversion actions like form fills to legitimize their ad click. These submissions are harder to reduce, so advertisers should consider a third-party tool like ClickCease to reduce spam traffic from display networks.”

You typically see CAPTCHAs when attempting to enter a password or sign up for an account. It requires users to complete a task that’s easy for humans but difficult for bots.

For example, before you can log in or move forward in an app, it asks you to type in the characters displayed in a distorted image, solve a simple math question, or select all of the school buses you see in a grid.

Like this:

(Image: Adobe)

CAPTCHAs are effective, but frustrating for users. Consider using more user-friendly versions like invisible reCAPTCHA that only triggers for suspicious activity.

Pro tip: It’s not ideal to rely on CAPTCHAs alone, because fraudsters are using advanced technology. For instance, some use optical character recognition (OCR) to bypass them. So double up your efforts by implementing multiple verification tools.

2. Google reCAPTCHA: The more user-friendly version of CAPTCHA

Google reCAPTCHA is a type of CAPTCHA created by researchers and later acquired by Google. It uses advanced techniques, such as invisible challenges and machine learning to distinguish between humans and bots.

What makes it better than traditional CAPTCHAs is that it only appears when it detects suspicious activity. For instance, too many login attempts or a sudden spike in traffic from a single IP address.

But before you adopt this technology, note that it may have privacy concerns, which may conflict with GDPR compliance.

For instance, using invisible challenges and machine learning to distinguish between humans and bots may involve collecting personal information and tracking behaviors, raising transparency concerns.

However, you’ll find plenty of websites using it for security and a better user experience.

I agree with it being better for users since, most times it only asks you to check a box:

(Image: Wappalyzer screenshot)

Pro tip: WordPress and other platforms have form builders and plugins to prevent spammy submissions and other vulnerabilities. So check out the tools before selecting your website platform. 

3. Honeypot fields: The sweet trap for bots

Here’s one you likely haven’t seen because they’re invisible. Honeypot form fields are behind the scenes, but are visible to bots.

Since bots can see it and are created to fill out all fields they find, they blow their cover by completing the form.

Here’s an example of the html code used to insert a honeypot field:

<input type=”text” name=”website” style=”display:none”>

Pro tip: Get creative with your honeypot field names. Instead of “honeypot,” try something like “favorite_ice_cream_flavor” to throw off more sophisticated bots.

4. Time-based restrictions: The speedster catcher

Banks, social media sites, and email service providers often use time-based restrictions to protect against bot attacks. But it’s not what you think — it’s not a countdown timer to make you fill in forms faster than a bot can.

Because we know nothing’s faster than a bot.

And that’s the caveat for spammers — this method pings submissions that happen faster than humanly possible. It works by setting a minimum time threshold between form load and submission. If a submission beats this threshold — say, 5 seconds — it’s likely automated.

Some sites use JavaScript to record the form load time and compare it to the submission time.

Here’s how it works:

1. Form load time: A user opens a web page with a form, JavaScript records the exact time the form loads. Think of this as starting a stopwatch the moment you see the form.
2. Submission time: When the user clicks “Submit,” JavaScript notes this time too. It’s like stopping the stopwatch when you’re done filling out the form.
3. Time comparison: The website then compares how long the form was open (Submission Time – Form Load Time) to a predetermined minimum time threshold.
4. Decision making: If the time taken is less than the threshold, it’s likely a bot (too fast for a human). If it’s above the threshold, it’s probably a legitimate human submission.

Pro tip: Don’t make your time threshold too long — you don’t want to penalize your fast-typing human users (like myself). 

5. Multi-step forms: The patience tester

I’ve seen this version on HubSpot — anytime I fill a form to download a report, it goes through multiple steps/pages before I can submit.

As you see below, I first have to enter my email address.

Then, move on to the next page to fill out my first name and last name, and select next again.

This continues until the end.

Now, why this works: bots often struggle with multi-step processes, making it harder for them to complete the entire form. But this can soon change with AI tools coming out that can perform multiple steps in one go.

Pro tip: Use multi-step forms not just for spam prevention, but also to improve user experience by making long forms less daunting. The next button could be the last and you’re only asking for one or two fields per page, so it doesn’t feel as big of an ask.

6. Email verification: The double-checker

I’ve signed up to my fair share of newsletters over the years, and most today require me to click a button or reply to show I am a serious human who wants to be subscribed.

It immediately sends a verification email to your inbox with a link or button to click. Then, another email confirms your subscription. If the person or bot fails to perform this step, you won’t be added to the subscriber list.

If you use this method, let users know during the sign-up stage to look for an email verification message in their inbox or spam folder.

Remember, combining these methods in your anti-spam campaign is the key to effective spam protection. Mix and match to block spam and always keep user experience in mind – after all, you want to block bots, not humans.

Pro tip: Make your verification emails engaging and on-brand. It’s another touchpoint with your potential customer so make it count.

Common types of spam submissions

It’s hard to defend against threats you don’t know, so we compiled a list of the top spam submissions we see on our client’s website forms:

Phishing attempts

Phishing spam submissions try to trick users into revealing sensitive information. For example, a contact form spam submission may claim to be from your bank, asking you to verify account details.

Your best line of defense: implement email verification and never request sensitive information through your forms.

Automated bot submissions

These are large-scale form submissions made by programmed bots, often with gibberish or repetitive content.

An example would be hundreds of form entries submitted within seconds, all containing similar nonsensical text (think Lorem Ipsum). Use CAPTCHA or reCAPTCHA to filter out bot activity and protect your forms.

Link building spam

See comments on your websites containing multiple unrelated links? Odds are, your site’s being used as part of a link building scheme to boost SEO. Prevent this by adding a link limit in forms and moderate comments before publishing.

Advertising spam

Advertising spam is similar to link building spam — both use your comment section as a means to share links to get more traffic. Or it could involve unsolicited promotions for products or services through your forms.

One way to combat this is to use keyword filtering to flag submissions with promotional content and review them manually.

Malware distribution

Now, here’s a scary one — these submissions link to sites that download malware onto users’ devices. For example, a form submission contains a link claiming to be a “required download” for accessing content.

Use secure file upload features and scan all attachments for malware to protect against this threat.

Data harvesting

The purpose of this spam is to collect personal information for later misuse. A common example: a bot submitting variations of email addresses to verify which are real.

So limit the number of submissions from a single IP address within a set time frame to deter this behavior.

Competitor sabotage

In some industries, competitors can be a bit petty. Some may use spam bots to submit false negative reviews or complaints through a feedback form to hurt your reputation and mislead your design team.

To get around this, add user authentication for sensitive forms like reviews or testimonials to reduce the risk of false submissions.

Amazon uses a verification badge to show reviews from users who actually bought the product.

Manual spammers

Manual spam is created by real people with malicious intent. An example: a person repeatedly submitting offensive or irrelevant content through a contact form. Use IP blocking and implement a user reporting system for problematic content to address spam form submissions.

Ghost spam

Ghost spam refers to false traffic or submissions that skew analytics data without interacting with your site. For instance, you may see contact form submissions in your analytics that never occurred on your website.

This inflates leads and conversion rates, which hurts decisio-making. Use server-side validation and cross-reference form submissions with server logs to identify and filter out ghost spam.

It’s a long list of possible spam scenarios, and it continues to grow — especially now that generative AI reared its head.

“It’s important to review lead quality to take any of the above steps to reduce spam submissions,” warns Dawson. “Developing patterns for spam is the best bet for mitigating disruption and reducing submissions.”

If you notice a certain keyword that results in higher spam rates, complete a cost-benefit analysis and determine if the spam submissions are sufficiently offset by valid submissions.

“Some search engines have overall higher spam rates, so the same cost-benefit analysis is recommended for your ad accounts and related spend,” continues Dawson. “Some of our clients will reduce budgets spent in search engines that produce higher levels of spam.”

The takeaway

Don’t let spam get you down. It happens to the best of us, but the best of us are avid in safeguarding our sites against various types of malicious activities. If you don’t feel confident in using these tips to prevent spam submissions, then we’re here to help.

HawkSEM’s experts are available and able to determine whether you’re experiencing spam, the types, and the best methods for prevention.

One of our clients reduced spam by implementing many of the above recommendations

“First, we implemented a fully integrated CRM that gave a wealth of information about each submission,” shares Dawson.

“From there, we implemented CAPTCHA and began to review the spam submissions that made it through. As we reviewed leads, we implemented conversion actions that were dependent on the submission being valid and not spam.”

These conversion actions helped our automated bidding strategy to find similar quality leads.

The result:

“We decreased spam rates by 2% while increasing overall lead totals by 54% and maintaining the same spend year over year.”

So spam prevention isn’t just for protection — it can help your bottom line. Get in touch with us today to learn more about how we can help your business do the same (or better).