How do I stop spam form submissions?
Last checked 31 Aug 2026
Short answer
Add a honeypot field, rate-limit submissions server-side, and validate inputs strictly; for public-facing high-traffic forms, add a CAPTCHA on top.
Layer defences rather than relying on one trick
No single measure stops all spam. Combine cheap, invisible checks first, and add visible friction (CAPTCHA) only if spam persists.
Practical steps, in order of effort
- Honeypot field: a hidden input real users never fill in; bots often do. Any submission with it filled is silently rejected.
Add a hidden honeypot field to the contact form. If it's filled in on submit, reject the submission without an error.
- Server-side validation: enforce format rules (valid email, message length limits) in the server function that handles the insert/email, not just in the browser — client-side checks can be bypassed entirely.
- Rate limiting: block repeated submissions from the same IP or session within a short window.
Rate-limit contact form submissions to 3 per hour per IP address in the server function.
- CAPTCHA: add this last, since it adds friction for real users. See how do I add CAPTCHA to Lovable.
Review what's already stored
If you already have submissions saved to a table, ask Lovable to help you spot patterns (same message repeated, obvious link-spam) before deciding which defence to prioritise.
What usually goes wrong
- Relying only on client-side checks: bots submit directly to your API/server function, skipping the browser entirely, so front-end-only validation stops nothing.
- Over-aggressive rate limiting: blocking by IP can catch legitimate users behind shared corporate or mobile networks — keep limits generous.
- Adding CAPTCHA too early: it costs conversions; try honeypot plus rate limiting first for low-to-medium traffic sites.
For an enquiry form on a small business site, a honeypot plus server-side rate limiting usually removes the bulk of spam without adding CAPTCHA at all.
Sources
Was this answer helpful?
Related questions
- AnswerWhere do Lovable form submissions go?Nowhere, by default — a form only exists on the front end until you connect a destination: a database table (Lovable Cloud/Supabase) and/or an outgoing email via an integration like Resend.
- AnswerHow do I email form submissions to myself?Connect an email integration (Resend is the standard option), then ask Lovable to trigger a server-side function that emails you the form data whenever it's submitted.
- AnswerHow do I save form submissions to a database?Connect Lovable Cloud (or your own Supabase project), then ask Lovable to create a table for submissions and wire the form's submit handler to insert a row into it, with row-level security limiting who can read the data.
- AnswerHow do I upload files through a form?Use Lovable Cloud's (or Supabase's) storage buckets: ask Lovable to add a file input, restrict file type and size, and upload to a storage bucket with access rules controlling who can read the file later.
