Contact form spam isn’t new, but the bots sending it changed a lot faster than most WordPress sites’ defenses did. A honeypot field and a basic CAPTCHA used to be enough. In 2026, they’re not always enough on their own, because a growing share of what’s hitting your inbox is written and submitted by AI, not a script running down a list.
Why Spam Filtering Got Harder in 2026
AI-powered bots that can read a form, generate a plausible response, and solve simple CAPTCHA challenges have scaled up fast. Imperva’s 2026 Bad Bot Report puts the growth at roughly 12.5x year over year, with daily blocked AI-driven attacks climbing from around 2 million to 25 million. That’s the reason a lot of site owners are seeing spam get past defenses that worked fine two years ago: the bots got better at looking human, not just more numerous.
Should You Still Use Google reCAPTCHA?
Worth reconsidering, for two separate reasons. First, reCAPTCHA has drawn real GDPR scrutiny over how much visitor behavior it tracks and where that data goes, even for visitors who never interact with the widget. Second, Google is folding reCAPTCHA into its Cloud Console billing, with free usage capped at 10,000 assessments before charges apply by the end of 2026, which can catch a busy site off guard.
Cloudflare Turnstile has become the most widely deployed alternative for exactly this reason. It verifies visitors without an interactive puzzle, doesn’t use tracking cookies, and stays free. If you’re setting up form protection from scratch in 2026, it’s the more defensible default over reCAPTCHA.
The Layered Defense That Actually Works
No single method stops everything, and that hasn’t changed. What’s changed is which layers still pull their weight:
- Turnstile or hCaptcha at the form level: stops the bulk of scripted and low-effort bot traffic before it submits anything.
- A honeypot field: still worth keeping, cheap to add, and still catches unsophisticated bots that fill in every field they find. It just isn’t the whole defense against AI-driven bots the way it was in 2022.
- Server-side validation of every field: a submission with a malformed email or a URL stuffed into a name field should get rejected before it reaches your inbox, not filtered afterward. The sanitization vs. validation guide covers how to do this correctly rather than relying on the form plugin’s defaults.
- Content-pattern filtering: Akismet or a form plugin’s built-in anti-spam add-on catches the submissions that get past the first two layers by scoring the actual message content.
- Fewer fields: a form with three fields has less surface area for a bot to exploit than one with ten, and it converts better for real visitors too.
Which Plugins to Actually Use
Akismet remains the broadest option since it filters comments and form submissions from the same account, and most major form plugins (WPForms, Gravity Forms, Contact Form 7) now ship a native Turnstile or hCaptcha integration rather than requiring a separate plugin. Rather than repeat a full comparison here, the contact form plugin comparison covers which plugin fits which use case.
If your forms are still getting through despite CAPTCHA, honeypots, and Akismet all running, the gap is usually in validation logic or plugin configuration rather than needing yet another tool. That’s a maintenance and care plan fix, not a new-plugin fix.
