Spam Bot Protection: Stop Form Spam at the Source

What is spam bot protection?

Spam bot protection is the set of measures that prevent automated scripts — not humans — from submitting your forms. It's the difference between "stop the form from being abused" and "stop the spam after it's already in your inbox". The latter is a losing game. The former is what Prosopo does.

If you're here because your contact form is producing junk submissions, your email is filled with spam from your own website, or your WordPress comments are disabled and you're still getting spam — you're looking for spam bot protection. Akismet, server-side keyword filters, and post-hoc email validation can't help, because by the time they run the bot has already submitted, your form has already processed, and your downstream tools (CRM, autoresponder, Slack alerts) have already fired.

Why form spam is a bot problem, not an email problem

The numbers tell a clear story:

• A single bot can submit a contact form hundreds of times an hour from rotating IPs.
• Most signup spam comes from a small set of evasion tricks — the Gmail dot trick, plus-tag suffixes, disposable email domains, VPN and Tor exit nodes.
• "Anti spam" plugins that scan content can't catch credible-looking submissions: a bot that writes "Hi, please send me a quote for your services" passes every keyword filter ever written.

Treat the symptom and you'll keep playing whack-a-mole. Treat the cause — block the bot before it submits — and the inbox quietens overnight.

Where bot form submissions cause damage

• Contact forms — your team wastes hours triaging fake leads.
• Newsletter signups — fake addresses inflate your list, hurt deliverability, and burn through email-marketing credits.
• Account registration — bots create accounts to abuse free credits, post spam, or set up for credential stuffing later.
• Comment sections — even with WordPress comments disabled on posts, bots find other endpoints.
• Order checkout — fraud testing card numbers against your live checkout.
• Feedback / survey forms — AI-generated submissions pollute your analytics and qualitative research.

How Prosopo stops form spam

Prosopo sits on your form and answers one question for every submission: is this a real person (or a trusted agent) — or is this automation? It does that with three layers:

1. Invisible behavioural detection. Cursor movement, scroll cadence, typing rhythm, device characteristics, JA4 TLS fingerprinting, and IP reputation. Real users pass without ever seeing a challenge.
2. CAPTCHA challenge-response — proof-of-work and image. Escalated only when behaviour is genuinely suspicious — so legitimate users see them rarely, bots see them constantly.
3. Spam Filter (standalone product) — blocks disposable email addresses, Gmail dot-trick variants, and traffic from VPN, Tor, datacenter and abusive networks. Each filter is independently toggleable.

Together this is spam bot protection that catches the patterns spammers actually use — not a content-keyword guess.

Spam bot protection by platform

If you know which form plugin or platform you need to protect, jump straight to the install guide:

WordPress

• Contact Form 7 spam protection — stop CF7 spam at the source
• Gravity Forms spam protection — stop Gravity Forms bot submissions
• WPForms spam protection
• Ninja Forms, Fluent Forms, Formidable Forms, Everest Forms
• bbPress, BuddyPress (via Jetpack), User Registration, MemberPress, Beaver Builder
• See the full list of 16 WordPress plugin integrations

Custom forms

• Custom PHP / Node / Python forms — API integration for any backend

"I've already got Akismet. Isn't that enough?"

Akismet is a content classifier — it scores the text of a submission to guess whether it's spam. That works for blog comments where the bot is obviously selling watches. It fails for:

• Contact-form spam written by modern AI models (the text reads like a legitimate enquiry).
• Newsletter signups (no content to classify — just an email address).
• Account registration (same problem).
• Anything coming from credible-looking email addresses with throwaway domains.

Prosopo blocks the bot, not the text. The result: Akismet's flaws — false negatives on AI-written content, no protection for non-comment forms — go away. Compare Prosopo to Akismet on the WordPress hub →

Free anti-spam protection that actually works

Prosopo's free tier covers 10,000 verifications per month with the same layered spam bot protection as paid plans. For most small sites, that's all the anti-spam protection you'll ever need. See pricing →

Related guides

• How to stop bot survey submissions — the same problem in survey research
• How to choose a GDPR-friendly CAPTCHA for WordPress
• Best CAPTCHA in 2026 — side-by-side comparison of every major provider