It is impossible to prevent spam submissions on the contact form, in addition to captcha, which items need to be checked?

Can't prevent spam submissions from contact forms, what else should be checked besides the captcha? First look at the scale: A report released on the same day states, In 2026, over 60% of unprotected form submissions are spam or bots - more than 60% of form submissions without protection are spam or robot behavior. This proportion means that doing only one level of protection is basically the same as not doing it, and the captcha only blocks the easiest batch of requests.

What can the captcha block and what can it not block?

AnQiCMS supports integrating reCAPTCHA captcha to prevent robots from submitting forms. It targets the type of "batch submission by automated scripts", and the effect is indeed direct. The limitations are also clear: one is that it can be bypassed, and manual captcha platforms and automated bypass solutions have long existed; the other is that it brings experience loss, as each additional verification step adds a layer of loss.

Therefore, the captcha should be positioned as a "means of reducing the amount", rather than a "means of blocking incoming traffic". The real way to eliminate the impact of spam submissions is through the processing chain after submission.

The first level to check: hidden fields and frequency

The honey pot field (an invisible input box to humans but filled by scripts) and submission frequency control are the cheapest layer. The criteria are: whether the same source will be rejected and recorded for repeatedly submitting the same form within a short period of time. Many websites allow spam submissions to pass smoothly because the interface only checks if the field is legally valid, never looking at whether this source is working in bulk.

This layer also has a point that is often overlooked: whether the form address can be directly listed. If the submission endpoint does not have source verification, scripts can bypass the page and directly call the interface, making the captcha on the page irrelevant.

The second layer needs to check: does the content layer have a fallback?

The final destination of garbage submissions is the database and page output. Even if the previous layers are penetrated, as long as there is filtering in the writing and display stages, the impact can be contained.

AnQiCMS's content security settings provide sensitive word filtering and keyword replacement, content review, submitted text is checked against rules before being stored, items that match go into pending review instead of being published directly. The value of this layer is that it does not rely on 'recognition robots', it only judges whether 'this content can appear', and is equally effective against garbage that bypasses rewriting. Authentication and injection face are handled by another layer: built-in JWT authentication, content sensitive word filtering and anti-crawling interference codes, used to defend against SQL injection and XSS attacks.

The third layer needs to check: whether the message and comment entry is the same.

Form spam is rarely just on the contact form. Messages, comments, and registration nicknames are the same origin issue, using a set of content rules to close is more stable than each form having its own set. AnQiCMS has a total of 14 GEO and SEO related background modules, including the comment anti-spam item, and modules such as llms.txt and sitemap are also on the same list, and the message list has also been incorporated into the unified background management, where you can see all sources at once when dealing with spam.

The method of judging whether there is a gap is very direct: list all the entry points where text can be written within the site - contact form, message, comment, search box, username - and then ask one by one whether there is content review on this chain. Any blank items in the list are places where spam will come.

Don't make the anti-spam into something counterintuitive.

Over-verification will block real customers. A common mistake is to set the captcha level to the highest and add seven required fields to the form, which reduces spam but also zero in on leads. The reasonable approach is to let the machine handle the first screening (frequency control and rules), keeping human friction to one or two steps, and handing over blurred content to the review queue instead of directly rejecting.

Common questions

Question: Is it enough to just add the honeypot field?Answer: Not enough. Honeypots are ineffective against direct interface calls that do not parse the page, and they need to be used in conjunction with frequency control and content filtering.

Question: What should you do if spam submissions get into the database?Answer: First, confirm that it has not been output to any page, then clean it up in batches by source, and add the matched rules to the sensitive word filtering and keyword replacement to prevent similar content from being added again.

Question: Should all forms be required to have a captcha?Answer: No need. Internal process forms can be replaced by permissions and frequency control, and public inquiry forms can be added with a captcha, leaving the experience loss to the truly open entrance to the outside world.