Contact Form Statistics 2026: Spam, Fields & Timing from 993 Forms

Methodology

• Source: the production database of splitforms, a hosted form backend. Read-only queries; only aggregate counts were kept. No submitted values, names, email addresses, domains or account identifiers were stored or published.
• Window: submissions received from 2026-07-03 00:00 UTC through 2026-09-30 23:59 UTC (90 days).
• Excluded: submissions sent from splitforms.com or localhost pages (dashboard tests and the playground).
• Quarantined spam: submissions stored with the spam flag by splitforms' rule-based content filter (a handful were marked spam by the form owner). Honeypot, time-trap, CAPTCHA and rate-limit catches are dropped before storage and are not counted.
• Spam signals: taken from the quarantine log, which records the triggering rules for each quarantined submission and has existed since 2026-08-14. A submission can trip several signals, so shares add up to more than 100%.
• Active forms: forms with at least 3 non-spam submissions in the window. A form's field count is the median number of fields across its non-spam submissions, excluding hidden plumbing fields (UTM tags, page URL, form name, submit button, timestamps, CAPTCHA tokens, honeypots).
• Field types: detected from field names (English plus common Spanish, Portuguese, French and German names). A form captures a type when the field appears in at least half of its submissions. A field whose value is a well-formed email address counts as an email field.
• Form purpose: classified from the captured field types, first match wins: job application, booking (date or time fields), quote (budget, quantity, timeline or a service picker without a message), newsletter (email plus at most one other field, no message or phone), general contact (message plus email or phone), lead capture (name plus email or phone, no message), other.
• Timing: UTC receipt time of non-spam submissions. Weekday shares are normalized per occurrence because the 90-day window holds 13 of six weekdays and 12 Thursdays.
• Message length: characters in the longest message-like field of each non-spam submission that had one.
• Suppression: any cell built from fewer than 30 submissions or forms is folded into "other" or left out. The largest single account's and single form's shares are published only as a rounded-up ceiling (under 5%), never as exact values.

Limitations

• splitforms customers skew toward developers, small businesses and static or Jamstack sites, so this is not a random sample of every form on the web.
• The spam share is a floor: honeypot and time-trap catches never reach storage. Spam is also highly concentrated, so the overall share is driven by a small number of heavily targeted forms.
• Hours are UTC. Customers sit in many time zones, so the hourly curve is a global aggregate, not local office hours.
• Field types and purposes come from name heuristics and can misclassify forms that use unusual or non-English field names.
• File uploads count only files that were stored. Uploads require a paid plan with storage connected, and files sent to other accounts are dropped, so the upload share is a lower bound.
• Time from page load to submit is not reported: the form_loaded_at timestamp is only used for the time-trap and is not stored, and the opt-in drop-off tracker covers too few forms to publish.
• A field named subject is reserved for the notification email subject line and is not stored, so it does not appear in the field counts.

Last updated October 1, 2026. Sample: 21,050 submissions (16,179 legitimate, 4,871 quarantined) to 993 forms; 1,316 test submissions excluded.