How to Stop Google Ads Lead Form Spam

A fake click costs you the price of the click. A fake form submission costs you considerably more: a salesperson's time chasing someone who does not exist, and — the part almost nobody accounts for — a conversion signal that teaches Google Ads to go and find more traffic exactly like it.

That second cost compounds. Every spam submission counted as a conversion makes your bidding worse at its job, which means more spam and less real business, funded by you.

Start with the honeypot, because it costs your visitors nothing

A honeypot is a form field that is invisible to people and visible to automated scripts. A human never sees it and leaves it empty. A bot that fills in every field it finds trips it, and you reject the submission on arrival.

It is the single most effective anti-spam measure per unit of effort, and unlike a CAPTCHA it asks nothing of genuine customers.

<!-- Hide with CSS, NOT type="hidden" — bots skip genuinely
     hidden inputs but happily fill this one -->
<input type="text" name="_hp" tabindex="-1" autocomplete="off"
       style="position:absolute; left:-9999px; opacity:0;" aria-hidden="true">

tabindex="-1" and aria-hidden="true" keep it out of the way of keyboard and screen-reader users, so it stays invisible to people using assistive technology rather than becoming a trap for them.

Then a submission-time floor

Record when the form loaded and check how long the submission took. Nobody types a name, phone number and email in under two seconds. This catches scripted submissions that ignore your honeypot, and it has no false-positive problem — there is no genuine user who fills a form that fast.

Reject automation user agents server-side

Scripted submissions frequently arrive with a user agent identifying the library that sent them. Check it on the server, not in JavaScript, since anything client-side is trivially skipped by a script that posts directly to your endpoint.

This is a low ceiling — anyone competent sets a browser-like user agent — but it is free and it removes the laziest third of the problem.

Rate limit per IP address

A cap of a few submissions per minute from one address stops flooding without inconveniencing anyone real. Be modest with the threshold: shared office connections and mobile carrier NAT mean several genuine people can legitimately share one address, particularly in India.

Why a CAPTCHA is usually the wrong answer

It is the first thing most people reach for and it deserves more scrutiny than it gets.

A CAPTCHA adds friction to every visitor, including the ones you paid to acquire, in order to stop a minority. It measurably reduces genuine completions. It is also, at this point, weaker than advertised — commercial CAPTCHA-solving services exist and are cheap, so anyone running organised spam is not stopped by it, while your actual customers are.

The honeypot plus timing check catches most of what a CAPTCHA would, invisibly. Reach for a CAPTCHA when those have demonstrably failed, not before.

The step that stops it compounding

Filtering stops junk reaching your team. It does not, by itself, stop the more damaging effect — which is what your ad platform learns.

If Google Ads counts a form submission as a conversion, then a campaign producing fifty spam submissions looks like your best performer and gets more budget. The fix is to make the conversion you report be something spam cannot fake: a lead your team qualified, or a deal that closed.

That is what offline conversion imports are for. Claudphic Ads does this automatically — it applies the honeypot, timing and rate-limit checks above on every landing-page submission before a lead is ever created, then reports only genuinely won leads back to Google. But the four techniques above are worth implementing whatever you use; none of them requires our product.

If your junk is arriving with the same phone number repeatedly, that is a specific pattern with a specific diagnosis — see what it means when the same phone number appears on multiple leads.