3 simple methods to block 99% of spam on your Webflow forms

Tutorial
3 min
Published on Jul 19, 2025
Updated on
Screenshot of the Gmail interface on a computer, showing the inbox with 152 unread emails in the “Primary” tab.
Use AI to summarize this article
Key points

A common issue with your website’s contact forms is bots.
Their messages clutter your inbox, your Slack, and even your CRM. Yet with Webflow, there are  simple and effective ways to filter them out. Do you know them?

Method 1: Webflow’s native option (very easy)

Just toggle 2 settings in your project’s configuration.
Once activated and published, a good portion of spam gets automatically filtered.

Webflow spam protection (bots/spam) native feature

Only limitation of this native solution? The code from this solution can sometimes conflict with other custom behaviors on your site. So how do you avoid that? With the second method.

Method 2: the hidden field

For this, just add an invisible field to your form. Let’s call it “bot,” for example.

Screenshot of Digidop’s contact form, showing the user interface on the left and the HTML/CSS code on the right, highlighting a hidden field used to filter out bots.

Since this field is hidden on your front-end, a real visitor will never see it. But a bot will automatically fill it out.

Screenshot of an email notification from Webflow showing a new form submission on the Digidop site. The message contains duplicated content promoting “shroom chocolates,” typical of spam or bot activity.

Then all you need to do is set up a filter in Make (or any other automation tool) to block all submissions to your CRM when this field is filled.

Screenshot of a Make (formerly Integromat) scenario connected to Webflow, showing an anti-bot filter configured to block form submissions where the “bot” field is not empty, before sending to Slack.

And result: 99% of spam from your forms is stopped.

⚠️ Heads up: this second solution does use Make credits for each operation. While it’s minimal, it’s worth knowing.

(Alternative) Option 3: Blocking via JavaScript

If you can add custom code, you can insert a small script to prevent the form from being submitted on the front end if the bot field is filled.

Why this solution works?

  • Lightweight and easy to control
  • No external tool required (saves $$)
  • Works instantly

To use it, simply add the script inside an Embed Code block on your page, or in Custom Code Settings > Before .

<script>
  document.addEventListener("DOMContentLoaded", function () {
    const form = document.querySelector('form');
    const botField = form.querySelector('input[name="bot"]');

    form.addEventListener("submit", function (e) {
      if (botField && botField.value.trim() !== "") {
        e.preventDefault();
        console.log("Spam détecté : formulaire bloqué.");
      }
    });
  });
</script>

Want to go further in reducing fraudulent submissions? Check out the OTP solution we integrated with Twilio Verify for IMB Bank.

Florian Bodelot
Florian Bodelot
Co-founder

Suggested articles

Screenshot of a Google search results page displaying an AI-generated response for the query “does blog have a sense in 2026?”.
Documentation
SEO

What is the future of blogs on corporate websites?

What is the future of blogs on corporate websites?
Abstract illustration representing the concept of server-side tracking
Documentation
Development

Understanding Server-Side Tracking Made Simple

Understanding Server-Side Tracking Made Simple
Illustration representing a Proof of Concept through visual explorations and creative references
Documentation
Development

Proof of Concept (POC): validating an idea before investing in a website

Proof of Concept (POC): validating an idea before investing in a website

Want to turn your website into your most valuable asset?

Contact us today