Remove any option that emails a copy of the message to the address typed into the form, and make sure visitors cannot change where it goes. Then use a maintained form tool and test it.

Your form, someone else's message

Most contact forms do one simple job. They take what a visitor types and email it to the business.

Some do a second job as well. They email a copy to the visitor, or they let the page decide who receives the message. That second job is where the trouble starts.

Automated programs look for these forms. They type a stranger's address into the email box and an advertisement into the message box, then submit the form thousands of times. Your server sends every copy, under your domain name.

You see none of it. Usually the first sign is that real enquiries stop arriving.

How a form gets abused

The first is the easiest to remove and the most tempting to keep. To a customer it looks like a courtesy. To a spammer it is a free mail server with your name on it.

What happens to your email

Mail providers keep track of where spam comes from. Once enough arrives from your server, its address lands on public blocklists that other mail systems check before accepting a message.

From then on, mail from that server is refused or filed as junk. That includes the form notifications meant for you.

On many small business hosting accounts, the same server also sends everyday email: quotes, invoices, replies to customers. Those start bouncing or vanishing into junk folders too.

On shared hosting the damage spreads to other sites on the server, and the host may suspend your mail, or the whole account, until the abuse stops.

The signs to watch for

Bounce messages for emails nobody in the office sent, often in a language nobody there reads.

A run of form submissions full of links, or a sudden quiet where enquiries used to be.

A customer mentioning that your reply landed in their junk folder, or a supplier saying an invoice never arrived.

A warning from the hosting company about mail leaving your account. Read it the day it arrives.

A worked example

A safety equipment supplier sold hard hats, high-visibility clothing, gas detectors and fall protection to contractors across the region. Most orders began as a quote request on its website.

The form had a box labelled "Email me a copy of this request", added years earlier so that purchasing staff could keep a record.

Over a long weekend a program submitted the form thousands of times, with strangers' addresses in the email field and pharmacy advertising in the message.

By Tuesday the server was on two blocklists. The supplier's quotes, sent from the same server, began landing in contractors' junk folders, and larger firms with strict filters received nothing at all.

The repair itself took a day. The copy box came out, the form moved to a maintained plugin with spam protection, and the host cleared the waiting mail. Each blocklist was then asked to remove the server.

The harder part was finding the quotes that had gone missing. Staff phoned every customer who had asked for one that week.

Giving customers a record safely

Owners keep the copy box because customers like a record of what they sent. There are safer ways to give them one.

The thank-you page can show the details back on screen, which reaches only the person who typed them.

If you want an automatic acknowledgement, make it a fixed message: thanks, it arrived, expect a reply by a certain time. Include nothing the visitor typed, not even their name, since spammers put links in the name box too.

A reply from a real person within a working day is a better record than either.

Who decides where the message goes

The address a form sends to should be written into the code on the server, where visitors cannot reach it.

Older form scripts kept that address in the page itself, in a hidden field. Anyone who saved a copy of the page could change it and send mail to anyone.

A menu that lets visitors choose Sales or Service should send a choice, not an email address. The server looks up where each choice goes.

And nothing a visitor types should end up in the lines at the top of an email, where a few extra characters can add recipients. Maintained form tools already guard against this; old scripts often do not.

Testing your own form

Fill in the form with an address you control in the email field. If a copy arrives with your message in it, the form can be used against you.

Find out which script or plugin runs the form and when it was last updated. Anything untouched for years is due for replacement.

Then ask your host how much mail the account sends in a normal week. They can see the outgoing queue; you cannot.

Spam protection is a separate job

Removing the copy stops strangers being spammed. Spam protection reduces the junk arriving in your own inbox. Both are worth doing.

A box visitors tick to show they are not a program, a hidden field that only programs fill in, and a limit on submissions per hour all help.

None of them replaces fixing the form. A form that can mail strangers will be found again.

The counter-case

A form that only emails the business, with the recipient fixed on the server and no copy, is of little use to a spammer. If that describes yours, spam protection is the only change worth making.

A business whose email runs on a separate service, rather than on the web server, keeps its everyday mail if the server is blocklisted, though form notifications will still suffer.

And a form built on a well-known plugin, kept updated, is already protected against most of this.

For every other form: remove the copy, fix the recipient on the server, and test it yourself.

The test and the fix

  1. Fill in your form with an address you own.
  2. Remove the send-me-a-copy box if there is one.
  3. Strip the visitor's text from automatic replies.
  4. Fix the recipient in the code on the server.
  5. Update or replace the form script.
  6. Add spam protection visitors barely notice.
  7. Ask your host about outgoing mail volume.

Step two is the change that does the most good. It removes the single feature that turns a contact form into a mail server for anyone who finds it.

Hidden code that puts a site to work for strangers is also the problem with free premium themes from download sites.

Frequently asked questions

How can a contact form send spam?

If it emails a copy to whatever address is typed in, programs enter strangers' addresses and advertising, and your server sends every message under your domain name.

What happens when the server is blocklisted?

Other mail systems refuse or junk its mail, including form notifications and, on many small hosting accounts, the quotes, invoices and replies your staff send every day.

Should I remove the send-me-a-copy option?

Yes. Show the details on the thank-you page instead, or send a fixed acknowledgement that contains nothing the visitor typed, not even their name.

How do I test my own form?

Submit it with an address you control in the email field. If a copy arrives containing your message, strangers can use the form the same way.

Is spam protection enough on its own?

No. It reduces junk in your inbox, but a form that can mail strangers will be found again. Remove the copy and fix the recipient first.

Who should choose where messages go?

The code on the server, never a field in the page. A visitor picking Sales or Service should send a choice that the server turns into an address.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Bounces for emails you never sent?

Send us your contact page address. We will test the form and tell you what it can be made to do.

Start a Conversation