formexposed
Get started
Contact form spam has a cause

Is your contact form exposed to bots?

Most spam is not bad luck - the form simply has nothing a bot would notice. See your site the way a bot does, in two minutes, for free.

Passive check: we read your public pages, we never submit anything. No account needed.

By starting the check you agree to our Terms of Service; how we process data is explained in our Privacy Policy.

4 of 5
contact forms have a gap

In our field run across well-known sites, most forms lacked at least one of the four basic protections.

2 min
from domain to verdict

A real browser loads your pages, finds the forms and tests what a bot would test. Then you get a report with screenshots.

0
messages sent to you

The free check is passive. Nothing is filled in, nothing is submitted - your inbox stays untouched.

How it works

A bot's view of your form, explained

Spam bots do not read your site. They look for a form, fill every field and press submit. Anything that stops them is what we check for.

Your website UA FormExposedBot Our crawler Honeypot field CAPTCHA Form token Timing check The checks 83 / 100 exposed
1

We load your pages

A headless browser opens your start page and a few linked pages, with a user agent that says who we are and respects robots.txt.

2

We find the contact form

Search boxes, logins and newsletters are recognised and set aside. The form that matters is the one a stranger can use to reach you.

3

We tell you what is missing

Each protection is checked and explained. You get a risk score, screenshots and a fix guide for your CMS - WordPress, TYPO3, Shopify, Webflow or custom.

What we check

Eight things a bot notices

The passive check looks at the form and the page around it. Verified owners can add an active check that sends one clearly marked test message.

CAPTCHA

reCAPTCHA, hCaptcha, Turnstile or Friendly Captcha on the form - the first thing a bot fails.

Honeypot field

A hidden field that humans never fill and bots always do. Cheap, invisible, effective.

Form token

A one-time token in the form, so a bot cannot post the same request a thousand times from a script.

Timing check

A timestamp or minimum time on the page. Bots submit in milliseconds; people do not.

Submit target

Where the form posts: a hardened handler, a mail-to link, or a third-party endpoint that anyone can hit.

CMS and form plugin

Which system built the form. It decides which fix guide you get - and which known weaknesses apply.

WAF / CDN

Whether a web application firewall or CDN sits in front of the site and filters the obvious.

Security headers

CSP, frame and content-type headers. Not spam protection as such, but a sign of how the site is looked after.

Our crawler identifies itself as FormExposedBot and honours robots.txt. Site owners can opt out at any time: /bot · /opt-out

WordPress · TYPO3

Free plugin: the check inside your dashboard

Install the formexposed plugin, click "Check now" and see the verdict under Settings. Because the plugin runs on your site, the site counts as yours - one click connects it to monitoring.

Download the plugin (zip) TYPO3 extension (zip) - with Powermail

GPL, no external scripts, sends only your host name. Coming to the wordpress.org directory.

Monitoring

Protected today is not protected forever

A theme update, a new plugin, an edited form - protection disappears quietly. With a free account your site is checked on a schedule and you hear about it first.

  • ✓Scheduled checks: monthly free, weekly or daily on paid plans
  • ✓Alerts by e-mail, webhook, Slack or Discord - only when something changes
  • ✓Active check for verified owners: one marked test message, no spam
  • ✓History and timeline per domain, for agencies with workspaces
See plans and prices

Questions people ask before they click

Does the check send anything through my form?

No. The free check is passive: it loads pages and reads the form. Only verified owners can enable the active check, which sends exactly one clearly marked test message.

Is this legal? You are scanning my website.

We read public pages the way any visitor or search engine does, with a named user agent, honouring robots.txt, and we never store personal data from your site. Owners can opt out at formexposed.com/opt-out.

My form has a CAPTCHA. Am I done?

Usually not. Many forms carry a CAPTCHA that is not enforced on the server, or a handler that accepts posts without it. The check looks at what the form actually requires.

What does the report look like?

A verdict (exposed, partially protected, protected), a risk score, a screenshot of the form, each check with its evidence, and a fix guide for your CMS. Free reports stay online for 30 days.

What does it cost?

The check is free and needs no account. Monitoring starts free with one domain and monthly checks; paid plans add weekly or daily checks, more domains, webhooks and workspaces.

Two minutes now, or spam for years

Type your domain, get the verdict, fix what is missing. The check runs on formexposed.com.

Check my form →

/bot · /opt-out