Mystery spam that looks like it comes from your Joomla site is almost always your own forms being abused as a relay, not a full compromise. Here's how to find the leak and shut it for good.

If your Joomla site is suddenly sending spam, or your mail provider is flagging your domain for it, the cause is rarely a full site compromise. Far more often it is one of your own forms being abused as a relay. The good news: a handful of settings usually stops it for good.

First, confirm it really is your forms

Before changing anything, trace where the mail is actually coming from. If you send through an SMTP provider such as SendGrid, Brevo or Amazon SES, open its activity log. It records the exact form, sender and recipient for every message, so you can see in minutes whether the traffic starts at a contact form, a registration email, or something else entirely. Guessing wastes hours; the log gives you the answer.

Disable the core Contact component if you don't use it

Joomla ships with a Contact component that exposes a public email form. If you rely on a third-party forms extension instead, that built-in form is just an open door. Unpublish the Contact menu items and disable the component so there is nothing there to abuse.

Turn off the "send a copy to sender" option

This is the single most common form-spam vector, and it catches even experienced admins. Many contact and form extensions offer a "send a copy to the sender" feature. A spammer simply enters dozens of email addresses in the sender field, and your server dutifully mails a copy to every one of them, turning your site into a free bulk-mail relay. Turn this off on every public form unless you have a specific reason to keep it, and even then validate the field to a single address.

 Turning off the send-a-copy-to-sender option in a Joomla contacts/forms extension

Put a real CAPTCHA on every public form

Automated bots submit the vast majority of form spam, so a working CAPTCHA removes most of it instantly. One thing to know first: Joomla removed the reCAPTCHA plugins from core in Joomla 5, so on current versions a CAPTCHA means either a third-party plugin (Cloudflare Turnstile, hCaptcha and reCAPTCHA all have Joomla extensions) or, on Joomla 6.1 and later, the new built-in option. That built-in Proof-of-Work CAPTCHA is based on the open-source ALTCHA library: it runs entirely on your own site with no external service, no API keys and no third-party data sharing, and it stops bots without asking real visitors to click anything. We covered how it works in The Future of Spam Protection: Inside Joomla 6's New PoW CAPTCHA.

 

Setting the default CAPTCHA in Joomla Global Configuration

Harden the rest of the surface

  • Enable CAPTCHA on user registration, not just contact forms; registration spam is a quieter but steady drain.
  • Keep every forms extension updated. Abandoned form extensions are a recurring source of holes.
  • Add server-side rate limiting or a WAF rule if a single form is being hit repeatedly.

The takeaway

Form spam feels alarming because the mail appears to come from your site, but the fix is almost always configuration, not cleanup. Disable what you don't use, turn off send-to-sender, put a real CAPTCHA on every public form, and use your SMTP logs to confirm the leak is closed. Ten minutes of settings work protects your domain reputation for good.