A rise in fake form submissions this summer isn't your imagination or your form's fault. AI-driven bots got better at pretending to be people. Here's how to fight back without turning your contact page into a chore.
What You'll Learn
- Why old-school CAPTCHA and honeypots alone no longer cut it
- What the data says about AI's role in the recent spike
- What a layered, modern spam defense actually looks like
- The categories of tools available for WordPress and HubSpot
- Quick options for Squarespace, Webflow, and other builders
Over the past month, several clients have asked us a version of the same question: why is our contact form suddenly drowning in garbage? Same form, same website, same low-key little "Get in Touch" button that's worked fine for years. Suddenly it's a firehose of fake names, gibberish messages, and the occasional offer to rank us first on Google.
Short answer: it's not your form. It's the bots.
The spam bots making the rounds in 2026 are frequently AI-driven. They render pages the way a real browser does, move the mouse in vaguely human patterns, and can talk their way through puzzle CAPTCHAs that used to stop them cold. The checkbox that said "I'm not a robot" is having a rough year.
The good news is that the fix isn't more friction. It's smarter, quieter layers working together in the background, so real visitors never notice and bots never get through.
Why This Got Worse This Year
A single old-school defense used to be enough. A honeypot field here, a CAPTCHA checkbox there, and most forms stayed reasonably clean. That era is over.
Contact Form 7, WPForms, Gravity Forms, and Elementor Forms are all now dealing with bots powered by AI, headless browsers, and human-like behaviour that make old-school captchas useless. The same shift is happening off WordPress too. On the HubSpot side, one recent industry roundup described junk contacts showing up as random characters in the "Company Name" field or fake addresses from untraceable domains, which will sound familiar to anyone checking their submissions lately.
- Imperva's 2026 Bad Bot Report found AI-enabled bot attacks, the kind built to generate realistic form submissions and clear CAPTCHAs, rose roughly 12.5x year-over-year, with daily blocked AI-powered attacks climbing from about 2 million to 25 million across its customer base.
- Security firm HUMAN reported AI-driven traffic grew 187% in 2025.
- Thales found 41% of bot attacks now run through Chrome specifically to look like a real browser session, rather than the more obvious scripted traffic of years past.
Worth noting: figures on "how much of the internet is bots" vary by source. Cloudflare's network-wide numbers put bot traffic closer to a third, while security vendors like Imperva and Thales report higher shares because their data leans toward the login pages, forms, and checkout flows they specifically monitor. Either way, the trend line, more AI-driven automation, more convincingly human-looking submissions, points the same direction across all of them.
None of this means your website is insecure or that you did anything wrong. It means the bots leveled up, so the defenses available have leveled up too.
The Modern Defense Stack (Platform-Agnostic)
Regardless of what your site runs on, the current best practice is the same idea: stack several lightweight checks so that if a bot slips past one, another one catches it. No single tool needs to be perfect.
Layers worth having
- Invisible, behavior-based bot scoring (reCAPTCHA v3, Cloudflare Turnstile)
- A honeypot field, still useful against basic bots
- Timing checks that flag instant, inhuman submissions
- Gibberish and nonsense-text detection
- Email and domain blocklists for known throwaway addresses
- Server-side validation, not just front-end checks
What each layer catches
- Scoring: sophisticated, human-mimicking bots
- Honeypot: basic scripts that fill every field
- Timing: bots too fast to be a real person
- Gibberish check: random-character junk text
- Blocklists: repeat offenders and disposable emails
- Server-side rules: anything bypassing your front end
WordPress: What's Available
Whether you're running Contact Form 7, WPForms, Gravity Forms, or Elementor Forms, the same categories of tools exist across all four, just under slightly different menu names:
- Invisible, behavior-based CAPTCHA. reCAPTCHA v3 and similar tools score visitor behavior quietly in the background instead of showing a puzzle, which is generally a gentler option for real visitors than older checkbox or image-based CAPTCHAs.
- Honeypot fields. Most form plugins support this natively as a hidden field that traps unsophisticated bots without any visitor-facing friction.
- Real-time filtering services. Tools like Akismet analyze submissions as they come in and flag or block suspicious ones before they land in an inbox.
- Cloudflare Turnstile. A frictionless, invisible verification widget that works independently of whether a site is hosted on Cloudflare.
- Form endpoint visibility. Some bots bypass a form entirely and post directly to the processing script if that URL is exposed in the page source, so this is worth a look alongside the tools above.
HubSpot: What's Available
HubSpot forms include automatic spam prevention built into the platform, and submissions flagged as spam are separated out into their own view rather than mixed in with regular leads. On top of that baseline, there are a few additional layers built into the product:
- CAPTCHA. HubSpot forms use Google's invisible reCAPTCHA, which challenges a visitor only if the system considers their behavior suspicious.
- Gibberish detection. A newer addition that flags meaningless or random character strings across form fields and routes them to a dedicated spam view.
- Email and domain blocking. Specific domains, including common free or disposable email providers, can be blocked from submitting a form.
- A spam submissions index. Flagged submissions live in their own view, where they can be reviewed and released if something was caught by mistake.
Squarespace, Webflow, and Everything Else
If a site runs on Squarespace, Webflow, or something else entirely, the same categories of tools tend to be available, just packaged differently:
- Form-agnostic services like Basin or Formspree sit between a form and an inbox, filtering submissions server-side.
- Cloudflare Turnstile works as a drop-in widget regardless of what platform is rendering the form itself.
- Native platform spam settings exist on most modern builders now, often tucked into the form's own settings panel.
- Email or phone verification steps are an option for higher-value forms like quote requests or demo bookings, where fewer, more qualified submissions matter more than raw volume.
Seeing a wall of spam in your inbox?
If your contact form has turned into a junk drawer, you're far from the only one noticing it lately. Scribendi can work with you to find the right combination of settings for your specific setup, whether that's WordPress, HubSpot, or something else entirely.
Common Questions About Form Spam
Is CAPTCHA still worth using in 2026?
Yes, but the invisible kind. Puzzle-based CAPTCHAs are increasingly solvable by AI, while behavior-scoring versions like reCAPTCHA v3 and Cloudflare Turnstile still add meaningful friction for bots without bothering real visitors.
Do honeypot fields still work?
Against basic bots, yes. Against AI-driven bots that render pages like a browser, a honeypot alone is not reliable. It still belongs in the stack as one layer, just not the only one.
What is HubSpot's gibberish detection?
A built-in feature that flags form submissions containing random or nonsensical character strings and routes them to the spam submissions index instead of creating a contact record.
Should I add a phone or email verification step to my form?
For high-value forms where lead quality matters more than volume, yes. It adds friction and will reduce total submissions, but it is one of the more effective filters against both bots and low-intent human submissions.
