Your enquiry form is full of leads from three states away, and the reason is not what most people assume.

These Are Not Spam, Which Is Why Spam Filters Miss Them

The first thing to establish is that out-of-area enquiries are usually genuine. A real person with a real problem filled in your form, wrote a real message, and is waiting for a reply. They simply live somewhere you do not work.

That distinction is the whole reason the usual tooling does nothing. A spam filter looks for automation, patterns and malicious content. An out-of-area enquiry has none of those properties — it is indistinguishable from your best lead except for one field. No amount of spam filtering will ever catch it, and adding more of it is wasted effort.

It also means the person on the other end deserves a clear answer rather than silence. A form that tells someone immediately that you do not cover their area is a better experience than one that accepts the enquiry and never replies.

Where They Actually Come From

Most businesses assume a targeting mistake in their advertising. That is one source, but rarely the largest. The common channels, roughly in order:

• National directories and lead aggregators. Your listing appears in a national index, someone three states away searches a generic service term, and your form is what they find. You did not choose this traffic and often cannot switch it off.
• Organic reach beyond your service area. A page that ranks well for a non-geographic term attracts everyone searching that term. The better your content performs, the more of this you get — it is a symptom of success, not a fault.
• Paid targeting spill. Radius targeting is approximate, interest-based targeting is worse, and location signals are unreliable on mobile. Tightening this helps but never eliminates it.
• People who moved, or are moving. Genuinely ambiguous. They may be searching from their current address for a service at a future one, which is a lead you might actually want.
• Referrals passed along informally. Someone recommended you to a friend without checking where you work.

Why Blocking by IP Location Does Not Work Here

The instinctive fix is to detect the visitor location from their IP address and block anyone outside the service area. This fails often enough to cause real damage, and the failures are invisible.

Mobile traffic is routed through carrier infrastructure that can place a visitor in a different city or region entirely. VPN use is now mainstream rather than technical. Corporate networks egress through a head office that may be nowhere near the user. And someone on holiday, at work, or visiting family is physically somewhere other than where they want the work done.

The deeper problem is that IP location answers the wrong question. It tells you where the visitor is sitting right now. What you need to know is where the job is, and those are frequently different places. IP geolocation has genuine uses — tailoring content, prefilling a region selector, analytics — but gating an enquiry form on it means silently rejecting real customers.

Filtering on the Phone Number Instead

The phone number a visitor types is a deliberate statement about where they want to be contacted, which makes it a far better signal than anything inferred from the connection. In the US and Canada the area code maps to a defined geographic region under the North American Numbering Plan, so a submission can be checked against your service area before it is accepted.

The check runs server-side against the submitted value. If the area code sits outside the configured region, the visitor gets an immediate message telling them so, and the enquiry never reaches your inbox. The feedback is instant and honest, and nobody waits on a reply that was never coming.

Outside North America the same principle applies through dial codes and national prefixes, though the geographic precision varies by country — some national numbering plans encode region tightly, others barely at all. Worth checking how your own market is structured before assuming the granularity is there.

The Edge Cases, Honestly

Area code filtering is better than IP filtering for this job, but it is not perfect and pretending otherwise leads to bad configuration.

Mobile numbers keep their original area code when someone moves, so a genuine local customer may carry a number from wherever they lived a decade ago. Number portability means the same is increasingly true of landlines. VoIP numbers can be issued for essentially any area regardless of where the holder lives. Each of these produces a false rejection of a real customer.

How much this matters depends on your market. In a region with high inward migration it can be a significant share; in a stable area it is negligible. The mitigation is to treat the filter as a first pass rather than a wall — keep a log of what was blocked and read it, so you can see whether you are losing genuine work and widen the configured area if you are.

What to Actually Implement

The working setup is narrower than most advice suggests. Validate the phone field server-side against a configured list of area codes for your service region. Show the visitor an immediate, plainly worded message when it does not match, rather than failing silently. Log every rejection with the area code and the form it came from, so the configuration can be corrected against evidence instead of assumption.

Keep it to the phone field. Adding a postcode field to cross-check adds friction to every genuine enquiry to catch a small residual, which is the same trade CAPTCHA makes on spam and is wrong for the same reason.

The measure of success is not zero out-of-area enquiries. It is that the time you spend qualifying and declining work you cannot take drops to near nothing, while the enquiries you can serve keep arriving unimpeded.

• The plugin we built for this — server-side area code validation against a configured service area, with an immediate visitor message and a blocked-lead log.
• Install it from WordPress.org — free, GPL-2.0+, no API key needed.