Form spam is automated junk submitted through public web forms, wasting staff time and hiding genuine customer requests.
The submissions may advertise, phish, or simply fill the queue, and they arrive without a person reading the form.
How it works
Public contact, comment, and registration forms are easy for a script to repeat.
Staff then spend the day discarding noise, and a real request can sit unseen among thousands of similar entries.
Raising the cost of each automated submission, limiting repetition, and giving people a review queue that surfaces likely human messages reduces the harm.
The aim is a usable form, not a puzzle that blocks the customers you wanted.
Concrete examples
- A contact inbox receives thousands of identical promotions overnight and the Monday staff cannot find the two real complaints.
- A comment section fills with links that no visitor typed, pushing genuine questions off the first page.
- A registration form creates empty accounts whose only content is a promotional name.
Protective measures
- Make automated repetition of a public form expensive enough that bulk junk is no longer cheap.
- Rate limit submissions and review bursts that share the same text or the same timing.
- Show staff a queue that highlights likely human requests so real customers are not buried.
- Remove junk on a schedule and keep a short record of the volume so you can see whether the control is working.
How CDPCaptcha helps
Proof of work raises the cost of automated clients that submit junk through public forms at high volume.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.