From Spam to Sign-Ups: How to Protect Your WordPress Lead Forms (Without Annoying Real Customers)

We talked about migrating your WordPress site to a better host with WP Engine. But what else can we do to improve the usefulness of our lead-generating website? After all, just having a great looking site ultimately doesn't do much for our revenue, and if it's not generating revenue, what's the point?

If you're not running an ecommerce site, your website's job is to get you in touch with prospective customers. And how do we get prospective customers to reach out to us? Through effective and frictionless lead forms.

Of course, you can add a chatbot or put your phone number somewhere on the site, but not everyone is going to want to call you or talk to a bot. So let's add some forms, much like the ones you'll see on this page. 

Many theme builders for WordPress offer out-of-the-box solutions for this, and as an entry-level solution, many of these forms work quite well. I use the Divi builder more often than not, and the built-in forms are just fine for most entry-level applications. Elementor has a very mature and overall great feature set in its form ecosystem. But neither of these are specialists in lead-capturing forms, so it really can be beneficial to look into a plugin like WPForms, which is what I'm using here. WPForms is going to give you a log of all your form entries, let you build out great looking forms that match your theme, and give you a ton of options for field types and conditional logic. Our goal here is to get exactly the information we need for the place your lead is in your funnel and no more. We'll get into this in depth later, but once you have leads filling out forms on a regular basis, you're doing better than 99% of websites out there. You have something potential clients care about, and they're willing to exchange some info for your services, if the follow-up is right.

Lead capturing forms do a wonderful job of getting your potential clients closer to you, but they also invite some other issues. One of those is the steady stream of bots you're eventually going to see coming through in your lead forms. All of my clients have dealt with this at one time or another, so I've got plenty of practice at figuring out what to do when every other form response is "We can help you get thousands of visitors to your site with this one trick!"

Bot responses are a numbers game, so you'll see them in vast quantities. Even one response makes this automated system totally worth the effort for the bot masters, and with the surge of accessible AI, many bots now are incredibly convincing. What used to be an immediate tell that you were dealing with a bot (misspelled words, grammar issues, strange characters) has been mostly eradicated in the bot world. If you have any experience with bots, you'll know them when you see them. 

The biggest problem with this isn't that you've been hacked, although that's a lot of site owners' first thought. The biggest issue is that in this vast sea of useless responses, you're going to miss that one lead that matters. When you're just starting out, this is a huge issue. One of my clients was seeing dozens of bot responses every week which was flooding the CRM they use and making it incredibly tiring to sort through the junk mail to get to the real potential leads. 

So what can we do? We have several options here, but keep in mind that any friction you add to the lead capturing process will weed out real potential leads. We need to handle this effectively with as few points of friction for the real people as possible.

Google reCAPTCHA v3 is the gold standard for this, and almost always my first tool when eradicating bots from forms. It's incredibly effective, invisible to the user, and free. It analyzes your activity to determine if you are, indeed, human, and then accepts or rejects the form submission. 

Honeypots are form fields that are hidden, built into the raw html. We humans won't see the field at all, therefore leaving it blank. Most bots, however, will see a form field and fill it out. When the form is submitted, if that field is filled in, the submission will be rejected. This works a vast majority of the time, but I've had a client with bot traffic not find this 100% effective, so we implemented the reCAPTCHA method above in addition to this. This dual approach will work for almost every website out there. It's also built into WPForms and most form builders and free.

These are a last resort.You've seen these. Add 12+13, pick all the images containing a bus, type the letters and numbers that have been distorted. These are going to introduce the most friction, and decrease your conversion rates heavily. Not only does this cause stress with end users, it's also a sign you haven't caught up with the times. The above methods are much more effective and ease the minds of users who are about to share likely personal information with you. With data privacy being a huge concern these days, users like to know they can trust the organization they're sharing these things with. 

You want as little standing between you and potential customers as possible, and you want consistency. Therefore, a layered approach is going to be your best bet here. We'll talk about implementing Google reCAPTCHA and honeypots in another article, but implementing this multi-ply approach is going to save you a lot of headache, bandwidth, and time. If you're still on GoDaddy, just know that bots LOVE those websites. You'll be fighting tooth and nail to keep bots away there, but migrating to a rock-solid host like WP Engine can be a great first line of defense, as they have some built-in defenses against this type of traffic. Go brush up on the how and why of migrating to WP Engine here. 

And, as usual, if you'd rather not do this yourself, you can always reach out to an expert like me to take care of the dirty work while you focus on your business.