Disclosure: SpamShield is built by JMS Dev Lab, the publisher of this blog. We will be upfront about that throughout, and the advice here works regardless of which tool you choose.
The spam hitting your Shopify contact form has a rhythm to it. A flood for a few days, then quiet. Another flood a fortnight later. Most merchants assume the timing is random — bad luck, or maybe someone posted the store URL somewhere it shouldn’t have gone.
It isn’t random, and it isn’t bad luck. There is a discovery process behind it, and once you understand how that process works, the flood-and-quiet pattern stops looking like noise and starts looking like exactly what it is: a schedule.
Here is the part that surprises people. A spammer never had to find your specific store. They found a pattern, and your store happened to match it.
Automated crawlers spend their time scanning the open web for one thing: HTML that looks like a contact form. They are not reading your products or admiring your homepage. They are looking at page source for the structural fingerprint of a form — a <form> element, an email input, a message textarea, a submit button.
Shopify makes that fingerprint extremely easy to spot. Every Shopify contact page is generated from the same Liquid form tag, which means the underlying HTML is close to identical across hundreds of thousands of stores. The field names are predictable — contact[email], contact[body] — and the submission endpoint follows a standard structure. From a crawler’s point of view, your store and ten thousand others are the same target wearing different paint.
That is not a flaw in Shopify. Consistent, accessible form markup is good engineering. But it does mean a crawler that learns to recognise one Shopify contact form has, in effect, learned to recognise all of them.
Discovery happens through a few overlapping routes, and none of them require you to do anything wrong:
This is why removing one source of spam rarely helps for long. The list you are on does not know or care what you have changed.
Once your form is on a list, it gets used in two distinct ways — and the difference matters, because it determines what can actually stop the spam.
The automated tier. Scripts submit templated messages to thousands of forms at once. This is the cheap, high-volume layer: crypto offers, generic SEO pitches, link-building requests. It is also the easy layer to stop, because the behaviour is obviously non-human — a form filled and submitted in under a second, hidden fields completed, no browsing beforehand.
The human tier. Your form also gets passed to people who are paid to fill out contact forms by hand. They open your contact page in a real browser, reference your store name, and type a message that reads like a genuine enquiry — because a person genuinely wrote it. We covered this category in detail in the five types of Shopify contact form spam. It is the hardest to filter, and it is the reason CAPTCHA does so little: a CAPTCHA only asks “is this a human?”, and a paid spam worker is a human.
The flood-and-quiet pattern you noticed is these tiers being worked through campaign cycles. A list gets actioned, then set aside, then actioned again. Quiet weeks are not the spammers losing interest. They are between runs.
If you assume the spam is luck, you treat each flood as a one-off and wait for it to pass. That assumption quietly costs you.
Six months of treating a scheduled problem as a random one, and the contact form — one of the most direct ways a customer can reach you — becomes the channel you trust least.
The instinct is to make the form harder to find. It does not work, for two reasons.
First, you cannot meaningfully change the HTML. The Shopify contact form structure is standard, and the whole point of your contact page is to be reachable. De-indexing it from search would hide it from customers far more effectively than from scrapers.
Second, you are already on the lists. Hiding better from this point forward does nothing about the discovery that already happened.
So the answer is not to be harder to find. It is to make the form itself reject spam at the point of submission — before anything reaches your inbox.
Because the spam arrives in two tiers, effective protection needs more than one layer:
Stack those layers and spam is filtered at the form, with no CAPTCHA puzzle in front of the real customer who just wants to ask about a product.
This is the approach behind SpamShield, which is live on the Shopify App Store. Plans start at $9/month with a 14-day free trial. You can also see how this compares to the alternative in why reCAPTCHA does not stop Shopify contact form spam.
Your contact form is not being targeted because of anything you did. It is being targeted because it matches a pattern, and that pattern put you on lists that keep circulating. The spam is not random — it is scheduled, and it will keep arriving in waves whether you wait it out or not.
You cannot become invisible, and you should not want to: the same visibility brings you customers. What you can do is make the form refuse spam at submission, so the waves break before they reach the one inbox your real enquiries depend on.
If you want to try SpamShield, it is on the Shopify App Store, or at spamshield.dev. If you would rather just talk through your spam situation first, get in touch — happy to help either way.