Runs locally · no signup
Contact form spam checker with fixes you can copy.
Paste the rendered HTML for any contact form. The checker audits spam resistance, correctness, and accessibility, explains each problem, and generates a safer version. Your code never leaves the browser.
What this audit can—and cannot—prove
Visible in your HTML
- Whether the form submits with POST to a real endpoint
- Whether an off-screen honeypot field is present
- Whether CAPTCHA or Turnstile markup is included
- Whether fields are named, labelled, and correctly typed
- Whether mechanical problems can be safely repaired
Requires a backend test
- Whether challenge tokens are verified server-side
- Whether IP or account rate limits are enforced
- Whether domain and origin restrictions are active
- Whether suspicious content is quarantined
- Whether failed checks preserve legitimate submissions
A high score means the visible form is well configured. It is not a guarantee that the receiving server rejects spam.
How to test your form
- Open the page containing your form, inspect the
<form>element, and copy its outerHTML. - Paste the rendered HTML into the checker and review failed checks first.
- Copy the suggested form, then restore any intentional custom fields or styling.
- Submit valid, honeypot-filled, and invalid-challenge tests to your real backend.
A practical form-spam stack
No single signal is enough. Use an accessible honeypot for simple bots, server-side timing and rate limits for automation, content checks for suspicious submissions, and a managed challenge only when the lower-friction layers are not enough.
splitforms applies server-side spam controls after the browser submits the form. See the spam-protection overview or compare honeypots and CAPTCHA before adding another widget.
Contact form spam checker FAQ
What does the contact form spam checker test?
It checks the form markup visible in your browser: POST method, submission endpoint, honeypot field, CAPTCHA or challenge markers, field names, labels, autocomplete, input types, and other form fundamentals. It also produces a suggested corrected form.
Can this tool confirm that my server blocks spam?
No. HTML cannot prove that a backend verifies CAPTCHA tokens, rate-limits requests, checks allowed domains, or filters message content. The report identifies client-visible protection and clearly separates checks that still require a server-side test.
Does the checker upload or store my form code?
No. Your HTML is parsed in a detached browser document and never submitted to splitforms. The tool does not render your pasted code into the live page.
Can it fix my contact form automatically?
It generates a suggested version with safe mechanical fixes such as POST, a real form endpoint when one is missing, an accessible honeypot, common autocomplete attributes, and corrected email or phone input types. Review the output before publishing.
Does a honeypot stop all contact form spam?
No. A honeypot catches simple form-filling bots without adding friction, but targeted automation can ignore it. A production form should combine client-visible traps with server-side rate limits, content checks, origin controls, and an optional managed challenge.
Does this work with React, Next.js, Vue, Webflow, or WordPress?
Yes. Inspect the live form in your browser, copy the form element's outerHTML, and paste that rendered HTML into the checker. The tool intentionally does not parse JSX, Vue templates, shortcodes, or builder configuration.
Fix the form, then protect the endpoint.
Create a splitforms endpoint and use the corrected HTML from the audit. Start free and test the complete submission path before publishing.
Protect my contact form