Best practices

How to Tell if a Contact Form Message Is Spam

6 min read

You open the contact-form inbox and there it is: another "Dear website owner, we can get you on page 1 of Google" pitch sitting next to what might be a real customer asking about shipping. Some are obvious, some are not.

This guide walks through seven signals that can help you assess an inquiry. Use them together by eye, or use the Spam Checker to see how content and reputation signals contribute to a score.

Quick check: paste it into a free spam checker

The SpamShield Spam Checker scores a supplied message from 0 to 100 using content and sender-reputation signals and shows which signals contributed. Treat the result as an aid rather than proof.

The seven signals below explain what a score can consider so you can apply the same caution during manual review.

1. The sender email address

A known disposable domain can raise the risk score, but the sender domain alone is not proof. Legitimate customers and small businesses may use free webmail, while unwanted senders may use established domains.

A mismatch between the sender’s claimed organisation and domain can justify closer review. Check it alongside the request, links, and other context.

2. The content pattern

Unwanted messages often repeat recognisable patterns. A close match to one of these is a strong reason for review, not proof on its own:

SEO / backlinks pitch — "get your store on page 1", "quality backlinks", "guest post opportunity".
Web-dev / redesign pitch — "noticed your site could use a refresh", "modern responsive redesign".
Crypto / investment scheme — "guaranteed returns", "limited spots", anything that wants you to move money.
Phishing / account suspension — "verify your identity", "your account is suspended", asks for credentials or a fee.
Generic mass marketing — vague flattery + a call-to-action, no specific reference to your store or product.

3. Links, URLs, and shorteners

Multiple URLs, especially shortened ones, can raise risk. A link in an unexpected field, such as a URL in the name field, is also a strong automation signal but should be considered with the rest of the submission.

Off-topic links to unrelated marketing, investment, or credential pages warrant caution and should not be opened during review.

4. Writing quality, tone, and personalisation

Specific references to your store, product, or a concrete question can support legitimacy. Generic wording such as "Dear website owner" is one spam signal, not proof on its own. Spam also tends to:

Use urgent or threatening language ("URGENT", "immediately", "your account will be closed").
Be in a different language than your store, or be machine-translated.
Be gibberish or random-looking strings (test posts from bots probing what your form does).

5. The form fields they filled (or did not)

Bots often fill fields they should not. A "name" that is actually a URL or a string of dashes is a giveaway. So is a "phone" field with letters in it, or a message that just repeats the name.

A filled honeypot field is a strong automation signal, but browser autofill, accessibility tools, or implementation mistakes can create exceptions. Test the field and combine it with other signals.

6. Timing and behaviour

An unusually fast submission, repeated identical messages, or a sudden burst can indicate automation. Timing alone is not proof because autofill, time zones, and legitimate repeated attempts can produce similar patterns.

You usually cannot see this from a single inbox message; timing and frequency checks require submission-level event data.

7. The hard cases: real-human spammers

Some unwanted outreach is sent by a person and may not trigger bot-pattern signals. Use the content, relevance, consent, and your contact policy together; a human sender does not make an unsolicited pitch a qualified inquiry.

Stop checking by hand — let it run automatically

Checking every message by eye works at low volume. SpamShield evaluates contact-form, sign-up, and review submissions with content, behaviour, and reputation signals, blocks high-scoring submissions, and quarantines borderline cases without presenting a CAPTCHA. There is a free plan.

Frequently asked questions

How can I tell if a message is from a real customer?Specific references to your store, product, or a concrete question can support legitimacy, while generic wording such as "Dear website owner" is a spam signal. No single wording pattern proves the answer, so check links, sender details, context, and other signals together.

Why am I getting so many SEO and backlink emails?Public form endpoints can be found and submitted to by automated tools, and the same pitch can be reused across many sites. It does not necessarily indicate a problem unique to your site.

Is it safe to reply to a suspicious contact-form message?Treat it like a suspicious email: do not click links, share account or payment information, or pay a "verification fee". Follow your organisation’s quarantine, reporting, and retention policy instead of replying.

Should I just delete suspicious messages?Follow your review and retention policy. Do not click suspicious links or share sensitive information. For recurring volume, use filtering and a review queue, and treat a checker score as one input rather than a final decision.

SpamShield evaluates form, sign-up, and review submissions using reputation, content, behaviour, and optional AI signals. Configured thresholds determine which submissions are blocked, while borderline submissions stay available for review. Any automated classification can be wrong, so test the setup and review uncertain decisions. It does not place a visible CAPTCHA on the protected form.

Get SpamShield free