By the Numbers: The Global Scale of Form Spam in 2026

Conversations about form spam tend to fixate on individual experiences — the cluttered inbox, the fake lead, the wasted support ticket. But form spam is not an individual problem. It is a structural one, affecting hundreds of millions of websites, billions of submissions, and a serious slice of global economic activity.

This piece lays out the numbers. Where a figure is well-sourced, it is cited to a named organisation with a date. Where a figure is an industry estimate or an illustrative calculation, it is labelled as one — because the goal is an accurate, defensible picture, not an inflated one.

The Platform Landscape: How Many Sites Are We Talking About?

Start with how many websites exist and what powers them.

Total websites globally: as of early 2026 there are roughly 1.4 billion websites, but only about 200 million are actively maintained — the rest are parked, inactive, or abandoned. (Sources: Siteefy; Hostinger, 2026)

WordPress: WordPress powers about 42.5% of all websites, per W3Techs (March 2026), and holds roughly a 60% share among sites running a detectable CMS. In absolute terms that is around 590 million sites. (Sources: W3Techs, March 2026; DemandSage, 2026)

Drupal: Drupal runs about 1.2% of sites with a known CMS. BuiltWith tracks over 424,000 live Drupal sites, with broader estimates including historical installs reaching 1.7 million. Drupal punches above its weight in the enterprise tier, holding a notable share of the world's highest-traffic sites. (Sources: W3Techs, March 2026; BuiltWith; Global Media Insight)

WordPress powers about 42.5% of all websites (~590 million). Drupal runs 424,000+ live sites with a strong enterprise presence. Sources: W3Techs, March 2026; BuiltWith; DemandSage

The Form Plugin Ecosystem: Scale of Deployment

Every one of those sites needs forms. The WordPress form-plugin ecosystem alone is an enormous installed base:

Combined, the top five WordPress form plugins account for more than 11 million active installations. Add Drupal's Webform module, Joomla's form components, and the standalone form tools used elsewhere, and the global installed base of web forms runs well into the tens of millions.

The Bot Traffic Reality

The threat comes into focus when you look at who is actually visiting these sites.

Imperva's 2025 Bad Bot Report found that automated traffic surpassed human traffic for the first time in a decade, reaching 51% of all web activity. Bad bots made up 37% of the total (up from 32% the year before), with good bots such as search crawlers at 14%. Simple bad-bot traffic grew from under 40% of all bot traffic in 2023 to 45% in 2024 — a jump attributed to AI tools lowering the barrier to building automated attacks. (Source: Imperva/Thales, 2025 Bad Bot Report)

Automated traffic now accounts for 51% of all web activity. 37% of all web traffic is malicious bad bots — up from 32% a year earlier. Source: Imperva/Thales, 2025 Bad Bot Report

Form Spam Volumes: The Daily Reality

Precise per-form spam averages are hard to pin down — the figures that circulate come from plugin vendors as illustrations, not measured studies, and volume varies enormously by traffic and exposure. As a common illustration, vendors like WPBeginner report an unprotected WordPress contact form collecting 15 to 20 spam submissions a day, with high-traffic sites seeing far more.

OOPSpam's data breaks spam down by form type:

Akismet, the most widely deployed WordPress spam filter, reports blocking over 500 billion pieces of spam across more than 100 million websites since its inception — around 7.5 million spam items an hour. (Source: Akismet.com, 2026)

Translating Spam into Economic Impact

Now connect the platform, traffic, and spam figures to real economic consequences. The calculations below are explicitly modelled estimates, built on stated assumptions.

Calculation 1: Time wasted on form spam across WordPress sites

Of the roughly 590 million WordPress sites, focus only on the ~200 million that are actively maintained, and conservatively assume 10 million of those run active, regularly monitored contact forms (defensible given 11 million-plus form-plugin installs). If even a fraction have fully unprotected forms, a conservative 25 million spam submissions a day — about 9 billion a year — is reasonable.

At 30 seconds to identify and delete each one, that is 75 million hours of wasted human time a year. At a blended $30 an hour, that is roughly $2.25 billion in lost productivity annually — from WordPress form spam alone, on conservative assumptions.

Calculation 2: CRM data pollution cost

Gartner estimates poor data quality costs the average organisation $12.9 million a year, and Validity found 44% of companies believe they lose more than 10% of annual revenue to it. Form spam is a direct contributor — every fake submission corrupts segmentation, inflates pipeline counts, and degrades analytics. (Sources: Gartner; Validity)

Calculation 3: Email deliverability damage

ZeroBounce's 2024 analysis found only 62% of the email addresses submitted for validation were valid — 38% invalid, fake, or disposable — with annual list decay in the mid-20s percent and over 5 million disposable addresses detected. When those addresses enter mailing lists, the bounces damage sender reputation, cutting delivery rates by around 20% for a score drop from 83 to 70. (Sources: ZeroBounce, 2024)

Calculation 4: Ad spend wasted on fake form conversions

Spider AF projects global ad fraud losses climbing past $41 billion, and Juniper Research found 22% of all digital ad spend in 2023 went to fraud. When forms are the conversion point for paid campaigns, every bot-generated submission is wasted spend and distorted ROI. (Sources: Spider AF; Juniper Research)

Akismet reports blocking over 500 billion pieces of spam across 100 million+ websites, averaging 7.5 million blocks an hour. Source: Akismet.com, 2026

The Consolidated Picture

What This Means for Your Business

These are not abstractions. They describe the environment your website operates in right now. If your site runs on WordPress or Drupal, has forms, and does no content-level moderation, you are exposed to the same forces generating every one of these numbers.

The problem is too large for manual review, too sophisticated for basic honeypot fields, and too nuanced for a binary bot-or-human CAPTCHA check. Content-level moderation — real-time scoring of every submission for spam, phishing, profanity, and junk — is the approach that matches the scale and the complexity of the threat. The numbers are clear. The only open question is whether your forms are protected.

References

W3Techs. "Usage Statistics and Market Share of WordPress / Drupal, March 2026." w3techs.com.

DemandSage. "WordPress Statistics 2026."

BuiltWith. "Drupal Usage Statistics." trends.builtwith.com.

Siteefy; Hostinger. "How Many Websites Are There." 2026.

Imperva/Thales. "2025 Bad Bot Report."

OOPSpam. "Annual Spam Report." oopspam.com.

Akismet. "Spam Protection for Websites." akismet.com.

ZeroBounce. "Email List Decay Report." 2024.

Gartner. "The Average Financial Impact of Poor Data Quality: $12.9 Million Per Year."

Validity. "State of CRM Data Management."

Spider AF. "Ad Fraud Trends 2025."

Juniper Research. "Digital Advertising Fraud Report."

FBI IC3. "2024 Internet Crime Report." ic3.gov.