Why Am I Getting Increased Spam On My Website?

Are you wondering why your inbox gets flooded with spam emails over time? Well, you’re not alone in this predicament.

This is a common concern among our customers and a frequent topic of support queries. What you’re facing is an issue affecting millions worldwide.

So, let’s take this opportunity to understand the mechanics behind these spam emails. Or, you could use the table of contents below to get right to the fixes.

The Reality of SMTP Plugins and Spam

SMTP (Simple Mail Transfer Protocol) is the standard technology for sending emails online. When you use a plugin like WP Mail SMTP, you optimize your website’s emailing system to work more efficiently.

Fix Your WordPress Emails Now

The plugin ensures that the emails you send actually reach their intended recipients and don’t just end up in the spam folder, which is crucial for businesses that rely on email communication for everything from confirmations to newsletters.

However, there’s a common misconception about SMTP plugins that “they increase the amount of unwanted emails you receive.” Let’s clear this up:  SMTP plugins do not create or generate spam.

You see, what happens is when you install a plugin like WP Mail SMTP, you improve your email deliverability. And, where emails were previously being lost or marked as spam, they are now successfully landing in your inbox.

So, while it might seem like there’s a sudden increase in spam, what you’re actually experiencing is previously unseen emails making their way to you due to the improved deliverability.

It’s not about more spam being sent your way, it’s about more of it being seen in your Gmail, Outlook, or Yahoo inboxes. Now that we’ve got that out of the way, why is it that spam seems to increase over time?

Why Does Spam Increase Over Time?

As we move towards smarter and more advanced technologies, the tactics used by spammers also change and improve. Persistent spammers constantly find new ways to bypass filters and get their messages into your email account.

It’s a numbers game for these guys! Out of millions or even billions of people, there will be a few, who click on an email mistakenly and fall prey to serious security risks. For instance, here are some of the tactics spammers use:

• Malware and Virus Distribution: Some scam emails contain harmful software designed to damage or take control of the user’s computer.
• Address Harvesting: Spammers collect email addresses from various sources to target with spam; your email is just one of the millions.
• Email Spoofing: Scammers disguise their identity by altering the sender’s address, making the email appear to come from a legitimate source.
• Phishing Attempts: Phishing emails trick recipients into revealing sensitive information. They often mimic the look and feel of emails from trusted entities.
• Image Spam: Spammers use images instead of text to evade text-based filters and urge innocents to click on an image link.
• Botnets: Networks of infected computers are used to send out bulk spam emails without the owners’ knowledge.

What’s crazier about these different spamming techniques is that they can be considered entire ‘industries’ run by spammers. How many bot attacks are you supposed to protect yourself from? And it doesn’t just end there.

As your website becomes more popular and visible, it naturally begins to attract more attention. This includes both positive engagement from your audience and unwanted attention from spammers due to the following:

• Interactive Features: Features like comment sections, forums, or contact forms can be exploited by spammers to post spam content or harvest information.
• Increased Exposure: The more people who know about your site, the more likely spammers will find it and target it.
• Public Email Addresses: If your contact information is more publicly available and visible, it’s easier for spammers to grab and target you.
• Search Engine Rankings: Higher-ranked sites on search engines are more likely to be targeted by spammers as they are seen as valuable platforms.

It’s important to understand these factors, as they directly influence why spam can be perceived to increase, either slowly or suddenly. Let’s say, you’re using a simple contact form. Even that’s vulnerable to spam activities.

The Role of Contact Forms in Attracting Spam

Earlier, we talked about how installing an SMTP plugin can be perceived to increase spam, while in reality, it’s just improving deliverability. This results in previously unseen spam landing in your inboxes.

Similarly, when websites use a form builder plugin to create contact forms or other types of forms, they start noticing an uptick in spam. What’s the reason behind this?

Well, contact forms are essential for communication on many websites, but they can also be a weak point that spammers exploit. Here are some vulnerabilities that spammers try getting around:

• Auto-Reply Systems: Spammers might exploit auto-reply features to confirm the existence of an active email address.
• Exposed Emails: Some contact forms directly expose recipient email addresses, making them easy targets for spam.
• Inadequate Filtering: If form inputs don’t have strong filtering, spammers can inject malicious content or spammy links.
• Lack of Captcha: Without a challenge-response test like Captcha, automated bots can easily submit spam through forms.

It becomes increasingly complex when customers seeking a solution encounter various websites offering conflicting advice on how to handle spam submissions. For instance, you may be told that:

• “Once Set, Contact Forms Are Safe Forever”: The threat landscape is constantly evolving. What worked yesterday might not work today. Regular updates and monitoring are essential.
• “My Site is Too Small to Attract Spam”: No site is too small. Automated spam doesn’t discriminate by site size; if your form is accessible, it can be targeted.
• “Spam is Just a Minor Annoyance”: Some believe spam is just a nuisance. However, it can lead to more serious issues like phishing attacks or malware distribution.
• “More Fields Reduce Spam”: Adding more fields to a form doesn’t deter spammers. Automated bots can still fill out numerous fields at once.

By understanding these vulnerabilities and misconceptions, you can take a more informed approach to secure your contact forms and reduce the amount of spam you receive. We’ll talk more about this in the next section.

But, if you’re one of those people who believe that “I’ve tried all fixes, nothing works,” it’s important to understand that while you may have tried different spam prevention techniques, there’s no one-size-fits-all answer here.

Effective Strategies to Combat Email Spam

It’s often hard to discover what type of bot is spamming your website, and the fixes for each spam technique are different. Sometimes, a single anti-spam prevention measure might work, but most often, you need to use a mix of different strategies.

If you’re using a form builder like WPForms (developed by the same team behind WP Mail SMTP), you’ll be pleased to hear that the plugin offers numerous AI spam filters and methods to prevent form spam in WordPress.

Check out the video above for some basics on using the WPForms plugin to stop spam from contact forms in WordPress, or follow the advice below to get started (we’ll also link to other helpful posts for more detailed instructions).

1. Use reCAPTCHA, hCaptcha, or Cloudflare Turnstile

One of the most advanced anti-spam measures involves using a CAPTCHA on your contact form to deter spam submissions.

reCAPTCHA, hCAPTCHa, or Cloudflare Turnstile can all be used to add a layer of verification that differentiates between human users and bots.

They make it necessary for users to perform a task that is easy for humans but challenging for bots, such as text recognition, image selection, or math formulas.

Depending on the settings you deploy and the type of CAPTCHA you use, it is also possible to use adaptive difficulty.

Here’s a brief overview of each CAPTCHA supported by WPForms, which you can setup almost instantaneously:

• reCAPTCHA: Developed by Google, reCAPTCHA is a widely used system that offers different levels of challenge, from a simple checkbox to image recognition tasks. It’s known for its effectiveness and user-friendliness.
  • Setup Guide: How to Set Up reCAPTCHA in WPForms
• hCaptcha: As a privacy-focused alternative to reCAPTCHA, hCaptcha offers similar functionalities but prioritizes user data protection and compensates website owners for their traffic.
  • Setup Guide: Integrating hCaptcha with WPForms
• Cloudflare Turnstile: This relatively new player aims to provide CAPTCHA services without interruptive challenges. It uses session and behavioral data to verify if users are human, promising a smoother user experience.
  • Setup Guide: Setting Up Cloudflare Turnstile in WPForms

Each of these CAPTCHAs has its strengths and can be integrated into your WPForms to enhance security and reduce spam. By clicking on the respective setup guides, you can find detailed instructions on how to set them up on your site.

2. Try the WPForms Custom CAPTCHA Addon

If you’ve already set up any of the above CAPTCHA on WPForms but still tend to receive spam form submissions, it might be time to try something that’s a little bit more custom fit to your website and its needs!

This is where the WPForms Custom CAPTCHA Addon comes in, which basically allows you to create your own challenge like logic-based questions or random math puzzles that bots won’t be able to solve.

It is the perfect option for those site owners who don’t want to invest in a separate service for managing spam submissions. By acquiring the WPForms Pro License, you can install and set up the Custom CAPTCHA Addon without any site keys.

3. Enable Anti-Spam Protection in WPForms

In addition to supporting a variety of CAPTCHA options, WPForms also offers additional anti-spam protection features. Among these, you’ll find that the WPForms anti-spam token is a great option to pair with any existing spam prevention techniques.

WPForms basically assigns a unique secret token to each submission behind the scenes. Spambots are unable to detect the token. And without it, they become stuck and are unable to submit the form. Real users aren’t even aware of its presence.

To activate this feature, open your form and go to Settings » Spam Protection and Security. On the right-hand side, toggle on the Enable anti-spam protection option, and you’ll be good to go within no time!

4. Enable Akismet Anti-Spam Protection in WPForms

As discussed earlier, having several anti-spam protection plugins or measures in place is always a good idea, even if you’ve integrated a CAPTCHA into your contact form. So, after you’ve enabled anti-spam protection in WPForms, try Akismet!

This will double the layer of security and anti-spam protection on your forms. You see, Akismet analyzes user behavior from the background and simply blocks spam entries if it finds any cause for suspicion.

All you have to do is open the form you want to filter spam for and navigate to Settings » Spam Protection and Security. Then, toggle ON the Enable Akismet anti-spam protection option.

Remember that this setting won’t show up in the form builder if you haven’t connected your site to your Akismet account. So, follow the steps in this guide to set up Akismet from scratch in WPForms.

6. Block Specific Email Addresses on Your Forms

We’ve talked about bot form submissions, but what about those people who fill out your form to get an idea about your products/services through dummy information? These are real people who visit your form again and again.

And since CAPTCHA and other anti-spam prevention techniques don’t really classify these entries as spam, since a real human is actually filling them out, it can be difficult to determine whether you’re approaching a real lead.

Fortunately, WPForms allows you to easily block or allow a list of email addresses so that these visitors can’t submit new entries anymore. Open your form, click on the Email field, and go to the Advanced Options tab to set up your Allowlist / Denylist.

7. Set Up a Keyword Filter to Block Profanity

In addition to setting up an Allowlist / Denylist in WPForms, this is another preventative measure to block spam entries from real people. Messages people send through contact forms are slightly different spam that CAPTCHAs usually can’t stop.

You can use the keyword filter tool that comes with WPForms to eliminate spam and foul language that people write in your forms. Just toggle on the Enable keyword Filter button and enter a list of terms you do not want to use in submissions.

Please be careful with this choice, though, because it will block all submissions with the words you add to the snippet. The key to effectively using this filter is to be very specific so you don’t block real messages.

8. Restrict Submissions by Country

Through WPForms, you can also create and use a country filter to allow or reject entries from certain places if you notice a lot of spam from people from a certain country (for example, by looking at their IP address).

One of the advanced spam-blocking tools that WPForms has is a country filtering tool. You only need to turn on the Enable Country Filter button, and then you can choose to either not accept entries from certain countries or only accept entries from those countries.

The phrase and country filtering tools you use, along with reCAPTCHA, Akismet, or anti-spam form tokens, are exceptional ways to prevent spammers, as they add multiple layers of safety to your forms.

More Questions about Spam Emails & Submissions

Fighting contact form spam is a common concern among our readers. Here are a few questions we receive frequently and their answers.

Why am I suddenly getting so much spam email?

You might receive more spam emails due to your email address being shared or sold to spammers, subscribing to newsletters or services that aren’t secure, or a lack of effective spam filters.

Spammers continually refine their strategies to bypass filters, so an increase can happen suddenly. Regularly updating your email settings and utilizing strong spam filters can help mitigate this influx.

How do I stop getting spam emails?

To stop getting spam emails, use robust spam filters and regularly update your email settings. Unsubscribe from unwanted newsletters and ensure that your email isn’t publicly accessible.

Consider using tools like WPForms with anti-spam features such as CAPTCHA or Akismet integration on your contact forms to prevent spam from entering your website and disrupting your lead generation process.

Is it better to block spam emails or just delete them?

It’s generally better to block spam emails rather than just deleting them. Blocking sends a signal to your email provider about the sender’s illegitimacy.

It also prevents future emails from the same source. Deleting only removes the email from your inbox without impacting future spam.

Do spammers know when you delete email?

No, spammers typically don’t know when you delete an email. Email services don’t provide the sender a read or delete receipt for privacy and security reasons.

Deleting an email is a local action within your mailbox and doesn’t send any information back to the sender.

Do spammers know if you open their email?

Spammers may know if you open their email if it contains a tracking pixel or link that you click. These tiny, hidden images or links can notify the sender when the email is opened.

To prevent this, disable automatic image downloads in your email settings and avoid clicking on any links in suspicious emails. Also, make it a habit to mark and report spam emails.

Do spammers know when you block them?

Spammers typically don’t receive a direct notification when you block them. However, if many people block the same sender, their email service provider might flag them as spam messages, affecting their ability to send junk emails. The immediate effect of blocking is simply preventing their messages from reaching your inbox.

Anyone can sign up to Google Postmaster Tools to see the number of spam complaints they receive. It’s unlikely that someone who’s deliberately spamming would bother to use Postmaster Tools, but legitimate senders might check those reports to see if their spam complaint rate is unusually high.

Can just opening a spam email cause problems?

Opening a spam email message usually doesn’t cause problems, but it can if it contains malicious links, attachments, or tracking pixels. It’s best to avoid interacting with spam altogether.

To stay safe, please make sure your computer’s security software is up-to-date, and don’t download attachments or click on links from unknown sources.

Next, Learn How to Improve Email Deliverability

Do you want to understand what email deliverability really is and how you can improve it? This is the perfect opportunity to check out our guide where we’re going to explain what email deliverability is and discuss best practices for improving it.

Fix Your WordPress Emails Now

Ready to fix your emails? Get started today with the best WordPress SMTP plugin. If you don’t have the time to fix your emails, you can get full White Glove Setup assistance as an extra purchase, and there’s a 14-day money-back guarantee for all paid plans.

If this article helped you out, please follow us on Facebook and Twitter for more WordPress tips and tutorials.