Website Forms Flooded With Spam or Fake Sign-Ups: Why It Happens and How to Stop It
A sudden flood of form submissions or fake sign-ups almost always means automated scripts (bots) have found a form on your site that accepts anything without checking who is sending it. It is rarely a personal attack; bots scan the web for unprotected forms and use whichever ones they find. It is stopped by adding a few layered checks on the server: a challenge service, a hidden trap field, limits on how often one visitor can submit, and email confirmation.
None of these fixes is exotic, but they have to be built into the form's server-side code, which is routine work for any team offering website and web application development. Until a developer can do that, there is a lot you can safely find out on your own.
Why is my website form suddenly getting spam or fake sign-ups?
Because a bot can use an unprotected form for something that makes its operator money. There are three common motives, and the content of the submissions usually tells you which one you are facing.
Advertising and link spam
Contact and comment forms get filled with sales pitches and links, in the hope that someone reads them or that the text ends up published on your site.
Testing stolen cards
If the form takes payment or saves a card, criminals may use it to find out which stolen card numbers still work. Stripe calls this card testing and describes the typical signs: a spike in failed or blocked payments and small payments with nonsensical names and email addresses.
Using your form to email other people
If your form sends an automatic reply or a welcome email, a bot can type in a stranger's address and put its own message in the name or comment field. Your website then delivers that message from your domain. Sign-up forms are abused the same way to bury a victim's inbox in confirmation emails.
Is form spam dangerous or just annoying?
It can be genuinely damaging, mainly to your email and your payments. Every fake sign-up that triggers an email costs you sending reputation: messages bounce from addresses that do not exist, and real people who never signed up mark them as spam.
Email providers act on those numbers. Amazon SES, for example, states that it places an account under review at a bounce rate of 5% or a complaint rate of 0.1%, and may pause sending at 10% or 0.5% (checked October 6, 2026). A paused account also stops your order confirmations, invoices and password resets.
For card testing, Stripe lists disputes, extra fees and a higher decline rate for genuine customers that can persist after the attack ends. Fake accounts also distort your sign-up figures and can hide real enquiries in the noise.
What can I safely check in about 10 minutes?
You can establish the scale, the target and the damage so far without changing anything. Work through these in order and write down what you find.
- Volume and timing. In your inbox or your site's submissions list, count roughly how many arrived in the last hour and the last day, and note when the first one came in.
- Which form. Check whether it is the contact form, newsletter sign-up, registration, checkout or a comment box. The email subject line or page name usually shows this.
- What the submissions look like. Note whether they contain links, random letters, or real-looking email addresses belonging to strangers. Do not click any links.
- Whether real enquiries still arrive. Send a test message through the form from your phone and confirm it reaches you. Check your spam folder too.
- Your email service dashboard. Log in to the service that sends your website's email and look at sent volume, bounces, spam complaints and any warning banner or notice about your account.
- Your payment dashboard, if the form takes payment. Look for a spike in failed, blocked or very small payments.
What should I not do?
Do not do anything that destroys evidence or adds to the email problem. In particular:
- Do not click links in the submissions or reply to them.
- Do not mass-delete the spam entries or fake accounts yet; a developer needs them to see the pattern.
- Do not send a newsletter or promotion to recent sign-ups until the list has been cleaned.
- Do not install the first anti-spam plugin you find, edit the form's code or change DNS records yourself.
- Do not assume a challenge widget that appears on the page is working. It may only be decoration, as explained below.
When should I call a developer, and what should I send them?
Call one straight away if payments are involved, if your email service has sent a warning, or if strangers are receiving email from your site. Otherwise it can wait a day, but not weeks, because sending reputation erodes with every batch.
Send the notes from your ten-minute check: the affected form and its web address, when it started, approximate volume, three or four sample submissions with their timestamps, screenshots of your email and payment dashboards, and the name of the platform or builder the site runs on. Say whether the form sends an automatic reply, since that decides how urgent the email side is.
How is form spam stopped, and how do I stop it happening again?
It is stopped by combining several inexpensive checks, because no single one holds on its own. Stripe's guidance says the same about card testing: firewall rules based only on IP address are usually not enough, and combining measures works best.
A challenge service
Google reCAPTCHA, hCaptcha and Cloudflare Turnstile judge whether a visitor looks human and hand the form a one-time token. Many now run in the background and only show a puzzle to suspicious visitors. The part that matters is invisible: your server must send that token to the provider for verification before accepting the submission. Cloudflare's documentation says plainly that the widget alone does not protect a form. Tokens are single-use and short-lived: two minutes for reCAPTCHA, 120 seconds by default for hCaptcha and five minutes for Turnstile (checked October 6, 2026).
A honeypot field
This is an extra field hidden from human visitors. Simple bots fill in every field, so any submission with that field completed is discarded. It costs visitors nothing, but it will not stop a targeted bot.
Rate limiting
The server caps how many submissions one address or session may make in a set period, which turns a flood into a trickle.
Email confirmation
New sign-ups get one confirmation message and nothing further until they click the link, often called double opt-in. Amazon SES recommends it to reduce both bounces and complaints.
Firewall rules
A web application firewall can block or challenge known bad traffic before it reaches the form. It is a useful outer layer, not a replacement for the checks above.
Accessibility
Picture and distorted-text puzzles lock out some real customers. The W3C note Inaccessibility of CAPTCHA explains that such tests can stop people with disabilities from completing a task, and prefers non-interactive approaches. Ask your developer for a background or checkbox mode and test the form with a keyboard and a screen reader.
Form protection is one item on a wider list; our web application security checklist for business covers the rest.
Quick answers
Why is my contact form getting so much spam?
Bots scan the web for forms that accept submissions without verification and fill them automatically. They do it to deliver advertising links, test stolen cards, or make your site send email to other people.
Will adding a CAPTCHA stop form spam?
It stops most automated submissions only if your server verifies the challenge token with the provider on every submission. A widget that is displayed but not verified on the server gives no protection.
Can form spam get my email account suspended?
Yes. If fake sign-ups cause your site to email invalid addresses or people who never signed up, bounce and complaint rates rise, and email providers review or pause accounts that exceed their limits.
What is a honeypot field?
A honeypot is a form field hidden from human visitors. Simple bots fill it in, so the server can discard any submission where that field contains a value.
Should I delete fake accounts and spam submissions right away?
Not before a developer has looked at them. The timestamps, addresses and content show how the bot works and which defense will stop it; clean up afterward.
Conclusion
A flooded form is a sign that the form trusts every submission, and the cure is a set of server-side checks rather than one plugin. Record the volume, the affected form and the state of your email and payment dashboards, avoid deleting evidence, and get a developer to add verified challenges, a honeypot, rate limits and email confirmation.
If you have no developer available, you can contact Entrant Technologies and we will take a look.