Contact Form Spam, Captchas and Lost Leads: A Cloudflare Fix

The contact page is where search traffic turns into enquiries, so it is the worst place on a site for friction and the worst place for junk data. Spam submissions make lead numbers look better than they are. A captcha, the usual answer to spam, puts a puzzle in front of the people you most want to hear from. There is a way to filter spam on the contact page without either cost, and it also protects the page’s place in Google.

The video builds a single Cloudflare firewall rule for one client’s Contact Us page. Their form already had a captcha and spam was still getting through, so the filtering was moved in front of the page instead of onto the form.

Spam is a reporting problem before it is an annoyance

Most sites track a contact form submission as a conversion, either as a key event in Google Analytics or as a conversion action in Google Ads. Every spam submission that gets through is counted the same way as a real enquiry. That inflates the conversion rate of the contact page, flatters the channels that send spam-heavy traffic, and gives automated bidding false signals about which clicks are worth paying for. Someone in the business also has to read and discard every fake message.

A captcha reduces some of that, but it adds third-party script to the page and an extra step for genuine visitors. People on the contact page are usually close to a decision. Slowing them down there is a poor trade, particularly when, as in this case, the captcha was not stopping the spam anyway.

What the Cloudflare rule does

The rule matches requests for the contact page from visitors who are outside the business’s main markets and are not on Cloudflare’s list of known bots. Those visitors get a JavaScript challenge, which automated spam tools generally cannot pass. Visitors from the main markets see nothing at all. Here is the expression from the video, written for an Australian business that also sells into North America:

(http.request.uri.path eq "/contact-us/" and ip.geoip.country ne "AU" and ip.geoip.continent ne "NA" and not cf.client.bot)

It runs on the free Cloudflare plan. The path has to match the site’s real URL exactly, including whether it ends in a slash.

Keep search engines out of the challenge

The not cf.client.bot condition is the SEO safeguard. Googlebot crawls mostly from the United States, so a version of this rule that exempts only your home country would challenge it on the contact page. It would fail to fetch the page, and the page could fall out of the index. Bing and the other verified crawlers are covered by the same condition. Never trim the expression down to a simple country block.

After deploying, run a live test on the contact page with URL Inspection in Google Search Console. A successful page fetch confirms Google can still reach it. Check the Pages report a couple of weeks later to make sure the contact page is still listed as indexed.

Match the rule to where you advertise

The countries you exclude from the rule should be the countries you market to. If a Google Ads campaign targets the UK but the rule only exempts Australia and North America, every UK visitor who clicks through to the contact page meets a challenge you paid to send them to. Before deploying, list the locations targeted in your ad campaigns and the markets you care about in organic search, and exclude all of them. A European business would swap in ip.geoip.continent ne "EU".

The rule covers one page only. If the site has lead forms elsewhere, such as a footer opt-in, a site-wide filter is the better tool, and the video mentions a separate walkthrough for that.

Measuring the effect

• Cloudflare: next to each rule the dashboard shows challenges issued and the CSR (challenge solve rate). Many issued and almost none solved means the rule is catching automation, not people. The video shows a login page rule with 15 issued and none solved in 24 hours.
• The inbox: count spam submissions for the same length of time before and after the change. This is the most direct measure.
• Analytics and Ads: form conversions should fall by roughly the amount of spam removed while genuine enquiries hold steady. Annotate the date so a drop in reported conversions is not mistaken for a drop in demand.
• Search Console: confirm the contact page stays indexed and keeps receiving its usual clicks and impressions.

If the solve rate climbs, real people are being challenged and the excluded markets need widening. The goal is balance: enough filtering to clean up the lead data, with no added friction for the visitors who are about to get in touch.