Can a bot submit your website form?
Many website forms look protected, but still allow automated spam submissions. Other protection methods can stop some bots, but often add extra steps for real visitors, such as CAPTCHA challenges or other verification tasks.
This tool lets you test your own website form against an automated form submission bot. Enter the URL of a form you own or manage, match the fields below, and see whether the bot can successfully send a message through your form.
This bot has previously been able to submit messages through:
- a weakly protected Contact Form 7 form.
- a WPForms form protected with a WPForms token.
- a honeypot-protected Elementor Pro form.
- the default WordPress comment form.
- a poorly protected WordPress login form.
Please only test forms, comment forms, and login pages that you own or have permission to test.
CAPTCHA-based protection can add friction for visitors and may also require careful privacy and compliance setup, especially when third-party services are loaded on your site. If you use Google reCAPTCHA, make sure you understand the relevant privacy and GDPR requirements.
dxw3 Spam Block helps block automated form spam without forcing real visitors to solve a CAPTCHA. Install it, activate it, and keep your forms easier for humans and harder for bots.
Instructions
Use the fields below to match the fields on your own form. Your form may have fewer fields. If your form has additional required fields that are not listed here, the test may fail even if the form is not strongly protected. Mapping the fields manually makes the test clearer, because you can focus on whether your form protection actually blocks automated submissions.