A contact form only needs three fields when spam is handled on the backend

Short answer: a good contact form is three fields (name, email, message) plus quiet spam controls behind it, not a ten field intake grid. Every extra field lowers completion, so keep the visible form small and push filtering to the backend.

For spam, layer cheap defenses instead of one blunt tool:

• Duplicate submission check by IP or field value stops the same message landing six times from one source, and it is free.
• Block disposable email domains (Mailinator, Temp-Mail, and similar) at submit time to kill throwaway address leads.
• Add Google reCAPTCHA only when bots are actually hitting a specific form.
• Email OTP with a 4 digit code, reserved for high value forms where the address has to be real.

Keep the contact form short and stack the spam checks behind it instead of bolting CAPTCHA onto everything. We wire these into the form spam protection settings so the visible form stays two or three fields.

What is getting through on your contact form right now, bots or junk leads?