Your contact form is lying to you: 8 “leads” in 10 days, all spam

We were checking email delivery on a client’s site — a local HVAC installer — and found something that looked like good news. The contact form had sent eight messages to the sales inbox in ten days, every one accepted by the mail service with a green “OK”.

Then we read the subjects. “Aloha writing about the price.” “Hello, i am wrote about price for reseller.” “Aloha, i am wrote about your the price for reseller.” Eight submissions. Zero customers. The form was working perfectly, for bots.

Why this matters more than it sounds

Spam in a sales inbox isn’t just annoying. It trains the person reading that inbox to skim and delete. The one real quote request that week — from someone who typed “Information request” and wanted a two-zone system priced — sat in a pile of “Aloha” and was answered late. On a form that feeds a sales team, spam has a conversion cost you never see.

It also tells you something about the site: if bots found the form, they’ve found the login page, the comment endpoint and everything else. The form is just the part you can see.

What we did (and didn’t do)

We did not add a CAPTCHA. Making a 60-year-old homeowner identify traffic lights to ask about an air conditioner is how you lose the lead you were trying to protect.

We added a honeypot: an invisible field that humans never see and never fill in, and that bots fill in every time because they fill in everything. Submissions with that field completed are dropped silently. Real people notice nothing. It took five minutes and cost nothing, and the “Aloha” messages stopped the same day.

Then we fixed the other half of the problem — making sure the real messages arrive and are trusted:

• Form email now goes out through a transactional mail service with a delivery log, so “did they get it?” has an answer.
• Reply-To is set to the customer’s address, so the salesperson hits Reply and it just works.
• The domain got proper SPF and DMARC records so Gmail and Yahoo stop treating its mail as suspicious — our free health check flags this, and most small-business domains fail it.

How to tell if your form has the same problem

1. Open the inbox your form sends to. Count submissions from the last 30 days. Now count the ones that were actually from a person.
2. Submit the form yourself from your phone. Time how long the email takes to arrive. If it doesn’t, you have a bigger problem than spam.
3. Look at the sender address on the email that arrives. If it’s the customer’s address, your host is sending mail as other people’s domains, and it will increasingly end up in spam.

None of this is hard. It’s just nobody’s job — until it is. On a Site Care plan, spam protection, delivery logging and the DNS records are part of month one, and we test the form every month so it stays that way.