Best spam filter for Squarespace contact forms (2026)

There is no single best spam filter for every Squarespace site. Start with the free protection Squarespace already gives you, and add a filter that reads each message only if polished sales pitches still reach your inbox after that.

The right choice depends on the kind of spam you get, so that is where to begin.

What kind of spam is getting through your Squarespace form

Contact form spam comes in two broad kinds, and they need different tools.

Robot spam. Random letters in the subject line, or the same short message with a strange link sent again and again. Squarespace lists these signs in its help article on form spam. A robot check handles this kind well.

Written pitches. A friendly note that mentions your business by name and offers SEO work or a "partnership". These are often written by AI tools or by people paid to fill in forms, so they pass robot checks. The security team SentinelLABS described one such tool, AkiraBot, that wrote a custom message for each site it targeted. Squarespace sites were on its list (SentinelLABS report).

Owners on the Squarespace Forum describe the second kind often. A typical story goes like this: the owner checks that reCAPTCHA is on, and the pitches keep coming anyway.

If most of your spam is the robot kind, the free fixes below may be all you need. If it is mostly written pitches, you will likely need a filter that reads the words in the message.

How to stop Squarespace form spam for free

Check that reCAPTCHA is switched on

Squarespace uses Google reCAPTCHA v3 on most sites. It runs in the background, so visitors never tick a box, and many owners assume it is off. It is on by default for form blocks, but older or copied blocks are worth checking (Squarespace Help).

1. Click Edit on the page.
2. Click the pencil icon on the form block.
3. Open the Storage tab and click Google reCAPTCHA.
4. Make sure Enable Google reCAPTCHA is switched on.

To test it, preview the page and click into a form field. The reCAPTCHA badge should show in the bottom right corner.

Report the spam that gets through

When Squarespace thinks a message is spam, it puts a warning at the top of the email. If it missed one, click Report spam in the email. If it flagged a real enquiry, click Report not spam. Squarespace says it uses these reports to improve its detection (Squarespace Help).

Make the form a little harder for robots

• Add a required dropdown. A question such as "What is your enquiry about" with set answers trips up simple scripts that only fill in text boxes.
• Add an easy check question. Ask for something any real visitor knows, such as the first letter of your business name. Keep it easy, because a hard question also stops real customers.
• Add a hidden field that only robots fill in. Hide one extra field with a little CSS so people never see it. This does not stop the message. It marks it, so a rule in your email app can sort it away.
• Keep your email address off the page. Squarespace notes that spam robots look for email addresses on websites (Squarespace Help).

Sort the rest in your email app

Squarespace form messages all arrive from the same Squarespace address (Squarespace Help). In most email apps you can make a rule for that sender with words you keep seeing in spam, such as "backlinks" or "guest post", and move those messages to a folder. Check the folder now and then, because a word rule can catch a real enquiry too.

Why spam still gets past Squarespace's reCAPTCHA

reCAPTCHA judges whether the visitor behaves like a robot. It never reads the message. A well-written pitch typed by a person, or by a tool that passes as one, looks fine to it. That is why owners with reCAPTCHA switched on still get "partnership" offers, and why the free fixes above help most with robot spam. Our guide to stopping Squarespace contact form spam explains this gap in more detail.

What are the spam filter options for Squarespace

If the free fixes are not enough, these are the realistic choices.

Swap in another form tool

You can replace the Squarespace form block with a form from another service, placed on the page with a Code Block. Jotform is one such service. Its help pages describe a CAPTCHA field you can add to a form, with hCaptcha as the default and other types to choose from (Jotform).

This suits owners who want more control over the form and do not mind it living outside Squarespace. You will need to style it to match your site. If you build a custom form, Cloudflare Turnstile is another free robot check, and it works without any other Cloudflare service (Cloudflare).

Keep your Squarespace form and add a filter that reads each message

This is where Pengon fits. You add one line of code in Code Injection, and your normal Squarespace form stays as it is. An AI reads each message and holds the spam in a dashboard, where one click on Recover sends a held message to your email. reCAPTCHA stays on, and the two work side by side (pengon.dev).

In our own test in October 2026, we sent 300 messages through the live filter, half spam and half real. It stopped 150 of 150 spam messages and delivered 144 of 150 real ones. The 6 it held by mistake were job applications and a sponsorship request. We wrote the messages ourselves, so this is our test, not an independent one (how we tested).

It costs $5.99 a month or $59 a year per site, excluding VAT, with a free 21-day trial and no card needed (pengon.dev). It needs a Squarespace plan that allows Code Injection, and it only works on Squarespace.

Use a general spam checking service

OOPSpam is a spam checking service that works with many platforms. Its Squarespace page says it checks message content with a machine learning model and checks senders against lists of known bad addresses (OOPSpam). On Squarespace, it runs through a separate automation service that passes each new form message to OOPSpam first. Its pricing page lists a free plan, and one account covers any number of websites.

This suits people who already use automation tools, or who look after sites on several platforms.

Other services in this space change often, so read each one's own page before you choose.

Which Squarespace spam filter is right for you

• Mostly robot junk with links: check that reCAPTCHA is on and add a required dropdown. This costs nothing.
• You want full control of the form: a form tool such as Jotform.
• Mostly polished pitches, and you want to keep your Squarespace form: a filter that reads each message inside Squarespace.
• Sites on several platforms, or automations already in place: a general service such as OOPSpam.

Whatever you pick, keep reCAPTCHA on and keep reporting spam to Squarespace. Both cost nothing and help every option above.