How to Stop Sales Pitches Coming Through Your Contact Form

reCAPTCHA can't stop sales pitches because a real person sends them, from a real browser and a real work email, and bot checks are built to let real people through. To filter pitches out, something has to read the message and decide whether the sender wants to buy from you or sell to you. You can get part of the way with form design (a "reason for contact" dropdown, a vendor address, keyword filters), or use screening that reads each message against what you sell and labels pitches before they reach you.

Below: what counts as a pitch, why bot defenses miss them, what each manual fix costs, and four example messages. For bots and fake sign-ups, see the full guide to stopping contact form spam.

GoodInbound Lead Screen catches the sales pitches your CAPTCHA lets through. It reads every submission against what you sell, with one script on your existing form and no CAPTCHA:

• Catches pitches from people and AI, so agencies, SEO offers, dev shops, and recruiters arrive labeled spam with a one-line reason.
• Real leads go straight through, with no puzzle or extra field for the visitor.
• Nothing is deleted, so a real lead screened out by mistake is one click from rescue, and your correction teaches the screen.
• You're notified only for the labels you choose, by email, Slack, or Telegram, and only real leads reach your CRM and ad platforms.

The free plan screens 500 submissions a month; the message check that catches sales pitches is on Pro. Start free, or read on for every method.

What counts as a sales pitch

A pitch is any message from someone who wants to sell to you rather than buy from you. Most fall into a few types:

• SEO and link building. "I found a few issues holding back your rankings. Can I send a free audit?"
• Web and app development shops. Offshore or nearshore teams offering dedicated developers, a redesign, or an app rebuild.
• Lead generation agencies. "We book 15 to 20 qualified meetings a month for companies like yours."
• Recruiters and staffing firms. Pre-vetted candidates, offshore staff, or "I noticed you're hiring".
• "Partnership" offers. Partnership in the subject line, a sales pitch in the body, such as co-marketing that turns out to be an ad buy.
• Guest posts and sponsorships. An article for your blog, a newsletter to sponsor, a podcast that charges guests.
• AI-written outreach. Any of the above with a personalized first line ("Loved your recent post on client onboarding"), written by a tool for every site on a list.

Some messages sit on the line, such as a consultancy that wants to resell your product. Those need a human look, not an automatic block.

Why pitches come through your contact form

Sellers use your form because it beats cold email:

1. It skips your spam filter. A cold email from an unknown domain often gets filtered. A form submission arrives as a notification from your own form tool, which your inbox trusts.
2. It reaches the people who reply. Contact forms usually notify sales or the founder, and get answered faster than an info@ address.
3. It's cheap at scale. Outreach teams work through lists of sites, filling in forms by hand or with browser automation, and AI writes a different opener for each.

Why reCAPTCHA, honeypots, and email checks don't stop them

Every common form defense asks one question: is this a bot? A salesperson isn't one.

Defense	What it checks	Does a person typing a pitch pass?
reCAPTCHA v3	A score from 0.0 (very likely a bot) to 1.0 (very likely a good interaction)	Yes, a real person scores as human
reCAPTCHA v2, hCaptcha	A checkbox or image puzzle	Yes, people solve puzzles
Cloudflare Turnstile	Background browser checks that tell humans from automated traffic	Yes
Honeypot field	A hidden field only bots fill in	Yes, a person never sees it
Email validation	The address is well formed, receives mail, and isn't disposable	Yes, sellers use their real work email

The last row is the one people miss. Bots use fake or throwaway addresses. A salesperson needs your reply, so the address is almost always real, usually on a company domain.

So turning reCAPTCHA up doesn't help: a stricter score threshold blocks more real visitors, not more salespeople. More in why reCAPTCHA isn't stopping your spam. For the bots themselves, reCAPTCHA alternatives compares the options and stopping spam without a CAPTCHA covers the invisible ones.

Manual fixes, and what each one costs

These cost little in software. Each costs something in lost leads or your time.

Add a "no solicitations" note

A line above the form, such as "This form is for customer inquiries. Vendors, please email vendors@yourcompany.com", is free. Some sellers respect it. Most don't read it, and tools that fill forms automatically never will. Add it, but don't expect much.

Add a "reason for contact" dropdown and route by it

Add a required dropdown with options like:

• I'm interested in buying
• I'm a customer and need help
• I'd like to sell or offer a service
• Press or partnerships

Then route each answer: buying to sales, help to support, selling to a vendor inbox checked weekly. WPForms does this with conditional notifications, and Gravity Forms with conditional logic on its notifications.

The cost: an extra required field for every real lead, and plenty of sellers pick "I'm interested in buying" because they know that option gets read. It sorts the honest sellers, not the rest.

Require company, budget, or timeline fields

Required fields like company, team size, or budget weed out low-intent leads, not sellers: an agency rep types the agency's name and picks a budget at random. Every field you add costs completions from real buyers, so add one only if you'd use the answer anyway.

Blocking free email addresses (HubSpot forms have a Block free email providers setting) fails the same way. Sellers use work email, and some real leads, often small businesses, use Gmail.

Block keywords

Most form tools can reject a submission that contains certain words. In WordPress, Contact Form 7 uses the Disallowed Comment Keys list under Settings → Discussion and doesn't deliver matching messages. WPForms has a keyword filter under Settings → Spam Protection and Security → Filtering in the form builder, and either rejects a matching submission with a "prohibited words" error or stores it as spam, depending on your settings.

Keywords catch the laziest pitches, and real leads too, because buyers and sellers use the same words:

Blocked phrase	Catches pitches like	Also blocks real leads like
SEO	"We'll get you to page one of Google"	"Will moving to your platform hurt our SEO?"
agency	"We're a growth agency helping SaaS brands scale"	"We're an agency with 30 client sites. Is there agency pricing?"
partnership	"Exciting partnership opportunity for your brand"	"We'd like a partnership to resell you to our customers"
developers	"Hire dedicated developers from $25 an hour"	"Do you have an API our developers can use?"
quick call	"Do you have time for a quick call this week?"	"Can we book a quick call to see a demo?"
guest post, backlinks	Guest post and link offers	Rarely anything; fairly safe

Matching is also cruder than it looks. Contact Form 7's list matches anywhere in the text and ignores case, so seo blocks a lead who mentions Seoul. Meanwhile AI-written pitches change their wording every time and avoid the obvious words. If you use keywords, stick to phrases no buyer would write, and flag matches instead of rejecting them.

Give vendors their own address

Publish a separate address, such as vendors@, in your no-solicitations note and on your contact page. Honest sellers use it, you read it once a week, and you have a one-line reply for pitches that arrive through the main form. It won't stop sellers who want to jump the queue.

Block the domain, not the sender

When the same agency keeps pitching, block its domain rather than one sender. Agencies rotate reps, so blocking an address stops one person; blocking the domain stops the company, until it switches sending domains. Never block free email domains like gmail.com, since real leads use them. In GoodInbound this is your always-spam domains list, next to always-lead domains for customers you never want screened.

Screen the message against what you sell

Every manual fix guesses intent from one signal: a dropdown answer, a word, a domain. When you read a submission yourself, you ask one question: is this person asking about what we sell, or selling something to us? Answering it takes the whole message and knowing what your business does. "We're a design agency" opens a lead if you sell to agencies, and a pitch if you don't.

That's what GoodInbound's message check does. It runs last in Lead Screen, after your own rules, how the form was filled in, the network, and the email identity, so bots and fake sign-ups are usually caught first.

1. You describe what you sell once. When you sign up, GoodInbound drafts a short lead description from your website, for example "Owners and operations leads at design agencies asking about pricing, demos, or moving their projects over." You edit it in a sentence or two.
2. Every message is read against it. A question about your product, pricing, a demo, or an integration is labeled lead. A message offering services to you is labeled spam with a reason such as "Selling SEO or marketing services" or "Recruiting or staffing offer". Gibberish, scams, and crypto promotion are junk.
3. When it isn't sure, it leans toward lead. A borderline message comes through as a lead, or as review when another check also had a doubt about the same submission, so you decide.
4. Nothing is deleted. Spam stays in the inbox, under Screened out. If a real lead lands there, one click moves it back, and the screen uses your correction on the messages that follow.

By default, leads and review notify you instantly, spam arrives in a daily summary, and junk and bots never notify you. Only real leads sync to your CRM and ad platforms, so a pitch from someone who clicked your ad doesn't count as a Google Ads, Meta, or LinkedIn conversion.

The message check is part of Pro: $29 a month ($290 a year) for 2,500 screened submissions. The free plan covers 500 submissions a month with the rules, behavior, network, and identity checks, which stop bots and fake sign-ups but don't read the message. To test one of your own messages, paste it into the free form spam checker with a line about what you sell.

Four example messages and how they're labeled

Say you sell project management software to design agencies, with the lead description above.

1. The SEO pitch

Hi team, I was looking at your website and found a few technical issues holding back your Google rankings. We've helped 200+ SaaS brands reach page one. Can I send over a free audit?

Label: spam, "Selling SEO or marketing services". It offers you a service and asks nothing about your product.

2. The real lead a keyword filter would block

We're a 14-person design agency still running projects in spreadsheets. Do you have agency pricing, and can we import our boards from Trello?

Label: lead, "Asks about pricing or plans". It says "agency" twice, so an agency keyword rule would have rejected it. Read against what you sell, it's a buyer describing the problem you solve.

3. The AI-written pitch

Loved your recent post on client approval loops, the point about async feedback really landed. Teams at your stage often hit a wall shipping roadmap features. Our dedicated React and Node engineers plug into your team within two weeks. Worth a 15-minute chat?

Label: spam, "Selling development or design services". No obvious keywords, a personal opener, a polite question. It still offers engineers to you instead of asking about your product.

4. The ambiguous one

Hi, I run partnerships at a small consultancy that sets up tools for creative agencies. We'd love to explore working together. Who's the best person to talk to?

Label: review. It might be a reseller who'd bring you customers or a consultancy selling its services, and the message check isn't confident either way. On its own, that comes through as a lead. Here the behavior check also noted that the browser's timezone didn't match the IP's location, and two doubts make it review: kept in your inbox, flagged for you to decide.

Which approach to use

Situation	What to do
A few pitches a month	A no-solicitations note with a vendor address, and block repeat domains
Pitches every week, mostly from honest sellers	A "reason for contact" dropdown that routes sellers to a vendor inbox
Pitches every day, or personalized AI outreach	Screen every message against what you sell
The form is the conversion for your paid ads	Screen before conversions are sent, so pitches don't train your bidding

Pitches are one kind of form spam. Bots, fake sign-ups, and disposable emails need other checks, covered in the guide to stopping contact form spam. If pitches are what's costing you time, GoodInbound's message check is built for it: describe what you sell once, add one script to your form, and pitches arrive labeled instead of dressed up as leads.

FAQ

Can reCAPTCHA or Cloudflare Turnstile stop sales pitches?

No. Both check whether the visitor is a bot, and a salesperson filling in your form is a real person in a real browser, so they pass the same way your customers do. Use bot checks for bots, and something that reads the message for pitches.

Does a "no solicitations" notice on a contact form work?

A little. Some sellers respect it, especially if you give them a vendor address instead. Most don't read it, and tools that fill in forms automatically never will. It's free, so add it, but don't rely on it.

How do I block vendor pitches without losing real leads?

Skip fixes that add friction for everyone, like extra required fields or blocking free email addresses, and don't auto-reject on keywords. Flag pitches instead of deleting them, so a real lead caught by mistake can be recovered. Screening that reads the message and keeps every submission does both.

Is it better to block the sender or the domain?

The domain, for a company that keeps pitching you: agencies rotate reps, so blocking one address stops one person. Never block free email domains like gmail.com. Domain blocks only stop sellers you've already seen.

What's the best anti-spam service for contact forms that catches human spammers?

Look for one that reads the message and knows what your business sells; a bot check or blocklist won't do it. GoodInbound Lead Screen does this on Pro ($29 a month): it labels pitches spam with a reason, keeps every submission, and learns from your corrections. The free plan stops bots and fake sign-ups but doesn't read the message.