Anti-spam teardown · Last resort
Taking the form down
Remove the form. Replace it with an email address, a phone number, or a calendar link. It is on this list because practitioners in our research actually did it, and because a category whose remedy is “delete the form” has a problem no amount of tuning fixes.
Corey Haines · San Diego · Aug 2026
One of 12 anti-spam teardowns. Bypass techniques change; this page states its date so you can judge how stale it is.
The short answer
It works completely and it costs you everything the form was for. The version worth knowing about is narrower: leaving the form up while removing it as a conversion action, which stops the ad platform learning from junk without stopping the leads.
What it stops
- Scripted botsMass submitters that never render your page.
- Yes
- Targeted automationHeadless browsers, solver services, residential proxies — aimed at you.
- Yes
- Paid humansPeople doing it by hand, cheaply.
- Yes
- Real people, bad leadsGenuine humans who were never going to buy.
- Yes
- Cost to the real buyerWhat it asks of the person you actually wanted.
- High
How it works
There is no mechanism to explain. You take the form off the page and put something else there: a mailto: link, a phone number, a booking link, or a login wall that moves the conversation behind authentication.
It is the only entry in this set with three yes marks on the scorecard, and that is not a joke at the format’s expense. It is the shape of the whole problem: the only defense that works on every attacker is the one that also works on every customer.
What it actually stops
Everything. And people reach for it, which is the part worth taking seriously — this is not a hypothetical, it is the last line of a real thread.
“We ended up taking down the page after 600 submissions.”
“If we stay on the current trajectory, websites will have to remove contact forms in the next few years due to the sheer volume of spam bots submissions.”
Two independent practitioners, sixteen months apart, one describing what they did and the other describing where he thinks the web is heading. Neither is a vendor and neither was selling anything.
How it’s defeated
It is not defeated. It is paid for, in full, by you.
A published address gets harvested within days, so you have traded form spam for inbox spam — with worse filtering, no routing, no structured fields, no attribution, and no record that a lead ever existed. Every real enquiry now arrives as an unstructured email that somebody has to notice, and the GCLID that told you which campaign produced it is gone, because there is no hidden field to carry it.
You have also removed the measurement, which means you can no longer tell whether the decision was right. There is no baseline to come back to.
When it’s still worth using
As a tourniquet: one page, during an active attack, with a date to revisit. Never as policy, and never site-wide.
But there is a middle version that is much more interesting, and it is the one people actually run. Leave the form up. Remove it as a conversion action.
“Since about April 2025, I’ve been getting a ridiculous amount of spam, and it seems like Google is continuing to optimize for these “cheap conversions”. I feel like I’ve tried everything. At this point, do I just remove form submit as a conversion action and keep phone calls? So frustrating :/”
That instinct is correct, and it addresses the compounding half of the damage rather than the visible half. Fake submissions are annoying once. Fake submissions reported as conversions are annoying forever, because the ad platform treats each one as an example of what to go and find more of.
“all those bot submissions were training Google’s/your ad network’s machine learning algorithm to send you more bot-like traffic.”
So removing the conversion action stops the loop. What it costs is the optimisation signal you were buying in the first place — you are now running paid acquisition blind, on a phone-call proxy, which works better than most people expect and is still a downgrade.
What to pair it with
No single method on this site is sufficient. These are the ones that fail differently enough to be worth running alongside it.
- OTP and SMS verification
- The defense to try before this one. If a phone number is a fair ask, you almost certainly do not need to remove the page.
- Geo-blocking
- A narrower blunt instrument. Refusing one region is a smaller amputation than refusing everyone.
- Cloudflare Turnstile
- What to put back when you restore the page.