A contact form spam filter cannot rely on the sender, because form notifications arrive from your own website and the person writing is usually a stranger, so it has to judge what the message says. It combines signals about the message into a score and holds anything above a threshold. It errs both ways: some spam gets through, and some genuine enquiries are held, unseen. Because spam usually outnumbers real messages, a filter can be right almost every time and still hold a large share of the enquiries you care about.
The short version
- Accuracy hides the expensive mistake. When one kind of message is rare, a model that never predicts it "would score 99% on accuracy, despite being useless", as Google's Machine Learning Crash Course puts it. In a hypothetical month of 950 spam and 50 genuine messages, a filter that is 99% accurate can still hold 5 of the 50 genuine enquiries: one in ten.
- Sender reputation has nothing to work with. Form mail comes from your own server, and the visitor's address is a Reply-To, which RFC 5322 describes as the address the author "suggests" replies go to. The visitor's IP address helps little: a 2019 IEEE study of residential proxies found that only 2.20% of the proxy IPs it detected had been reported by at least one blacklist.
- GDPR allows filtering, with conditions. Form messages are personal data. Most businesses rely on legitimate interests, which the ICO breaks into a purpose, necessity and balancing test. Keep content only as long as needed, mention screening in your privacy notice, and expect any language-model provider to be listed as a sub-processor.
- A held message is only safe if someone can find it. A filter should keep what it holds, say why, and let you release it. A folder nobody opens is a bin with a delay.
- Measure before you trust. Run the filter in a dry run, where everything is delivered and decisions are only recorded, then count the genuine messages it would have held.
Where to start
- Why blocklists do not work on a contact form: what SPF, DKIM, DMARC and blocklists check, and why on a form they describe your own website.
- Spam filter false positives: what a held enquiry really costs: how precision, recall and base rates interact, and how to price a held enquiry.
- GDPR and contact form spam filtering: lawful basis, retention, privacy notices and providers.
- What 598 contact pages look like from the outside: a study of 598 small-business contact pages and how much of each one a single static fetch can see.
Terms used here
- False positive: a genuine message the filter held as spam.
- False negative: a spam message the filter let through.
- Base rate: how common each kind of message is to begin with.
- Threshold: the score above which a message is held. Lowering it catches more spam and holds more genuine mail; raising it does the opposite.
- Blocklist: a published list of IP addresses or domains with a bad record.
- Lawful basis: the reason under GDPR Article 6 that permits processing personal data. For spam filtering it is usually legitimate interests.
Related on this site
- How it works: the signals, weights and per-inbox threshold behind each Humainbox decision, and the dry run every new inbox starts in.
- AI spam that reads like a real enquiry: the polite, machine-written messages that pass the older checks.
- How to stop contact form spam without a CAPTCHA: what to do instead of adding a puzzle to the form.
- AI-written spam: what AI-generated spam looks like arriving through a form.
- Contact forms: how the form on your own site sends mail, and where it goes wrong.
Sources
- Classification: accuracy, recall, precision and related metrics (Google for Developers)
- RFC 5322, section 3.6.2: originator fields (IETF)
- Resident Evil: Understanding Residential IP Proxy as a Dark Service (Mi et al., IEEE S&P 2019)
- What is the legitimate interests basis? (Information Commissioner's Office)