Reduce spam in your landing-page contact form

Separate spam from delivery and qualification problems

Not every unhelpful enquiry is a bot. An irrelevant human request, a repeated test, an automated flood, and a form that never delivers require different fixes. Before changing your form, record what you observe: repeated text, bursts from one source, empty fields, suspicious links, or genuine people asking for a service you do not offer.

If expected enquiries are missing, begin with form troubleshooting. Adding friction to a broken delivery path will not recover those messages. If the problem is poor fit, clarify the offer and qualification questions before asking every visitor to solve a challenge.

Keep the honeypot in the form contract

A honeypot is a field that ordinary visitors do not fill but some automated scripts do. Pageree’s current form contract requires an off-screen text input named _hp. Its edge handler silently drops a submission when that field contains a non-empty value. The response can appear successful even though no lead is delivered; this avoids teaching a simple bot which field triggered the filter.

The snippet below illustrates only the honeypot element, not a complete publishable form:

<input type="text" name="_hp" tabindex="-1" autocomplete="off"
       style="position:absolute;left:-9999px" aria-hidden="true">

Ask your assistant to follow the full current page, form, and privacy skills, including labels, named fields, validation, and consent controls. Do not remove the honeypot during a visual cleanup just because it is absent from the screenshot. Other platforms also document this technique; Webflow’s honeypot guide is one example, with its own implementation rules.

Understand what validation can prove

Pageree validates submissions against the published form schema. Required fields, email format, length restrictions, and supported option values can reject malformed input. Unknown fields are dropped. This makes a typed form more dependable, but it cannot prove a syntactically valid email belongs to a person interested in your service.

Use realistic limits. A short enquiry does not need unlimited message length; a quotation request may need enough space to explain an unusual job. Avoid mandatory questions that merely restate what the page already knows. The form-field guide helps choose useful qualification without turning an enquiry into a questionnaire.

Rate limits reduce bursts, not every unwanted message

The current Pageree page-router configuration, reviewed September 15, 2026, includes per-IP and per-page edge limits: five requests per IP and sixty per page within sixty seconds. These are operational controls, not promised global submission allowances. Edge counters operate per Cloudflare location, and additional shared account/page controls can affect acceptance.

The handler checks limits before parsing the form. A JSON request that exceeds a limit can receive HTTP 429; a plain form flow is redirected with an error state. Limiter failures can also reject temporarily. Do not claim “the message was sent” when the request was rejected.

These limits reduce rapid abuse. A slow bot that leaves the honeypot empty or a human spammer can still submit plausible data. This guide does not claim zero spam, native CAPTCHA, or automatic content moderation that has not been verified.

Ask for a focused inspection

Inspect the form on my existing Pageree page [URL or page ID].
Read its current source and published form schema before proposing changes.
Check the required _hp field, field names, validation, privacy controls,
and success/error behavior. Identify observed defects separately from suggestions.
Preserve legitimate visitor access and the current delivery destination.
Do not add an unverified CAPTCHA or promise to eliminate all spam.
Show a revised private preview if markup changes are needed; wait for approval.

Test a normal submission with controlled details and a missing required field. If inspecting honeypot behavior in a safe test setup, remember that its apparent success intentionally differs from normal delivery. Do not stress-test a live endpoint or send a burst of messages to establish the rate limit.

Keep a usable recovery and response process

Accepted Pageree enquiries have a 30-day recovery backup. That helps investigate delivery failures; a request rejected by validation or silently dropped as honeypot spam is not an accepted lead to recover. Owner email fallback also does not certify that a CRM received the record.

Keep a few redacted examples and approximate timestamps when reporting recurring abuse through support. Use those observations to choose the next change. Review the email-delivery guide when the issue is receipt, and improve offer clarity when real visitors consistently ask for the wrong service.