Why your spam filter stopped catching contact form spam

Contact form spam used to announce itself. Now it references your work and asks for fifteen minutes. What changed, what the research shows, and how to filter it without losing enquiries.

For about fifteen years, contact form spam was easy to describe. It was badly written, it was selling something absurd, and it arrived in bursts from the same handful of addresses. Every tool built to stop it — keyword lists, honeypot fields, Akismet, reCAPTCHA — was built against that description.

Then the description stopped being true.

What arrives now

A typical message now looks like this. It is an illustrative composite, not a real one, but anyone who reads a small business's contact form will recognise it. Nothing in it is misspelled. Nothing in it is absurd.

Hi,

I came across your site and was really impressed by the staircase work — the cantilevered oak piece in particular. We help craft businesses reach more of the right customers without the usual agency overhead.

Would you be open to a quick 15 minutes this week to see if it is a fit?

Imagine that arriving at a joinery workshop. A keyword filter finds no keyword. A honeypot finds no bot, because a human-shaped tool filled the form in a human-shaped way. An invisible CAPTCHA scores it as a person, and in the sense that CAPTCHA means, it may well have been one.

The only thing wrong with that message is the thing no rule can measure: it does not actually say anything. Strip the flattery and the specific noun that was scraped from the homepage, and there is no question in it, no reference to anything the business does that a directory listing would not know, and no reason it was sent to this workshop rather than to four thousand others.

This is no longer a hunch

For a while the change was anecdotal. It has since been measured, mostly in email rather than in contact forms, but the direction is the same.

Spam is now mostly machine-written. Researchers from Columbia University and the University of Chicago, working with the security company Barracuda on hundreds of thousands of malicious emails, estimated that at least around 51% of spam in their dataset was generated using language models as of April 2025. They calibrated their detectors against mail sent before ChatGPT existed. The machine-written spam was more grammatically correct and more formal than the human-written kind, and many campaigns were sent as reworded variants of the same message — which, the authors note, may be an attempt to get past filters that look for identical mail sent in volume or for particular combinations of words.

Bots are reaching forms. DataDome, a bot-protection vendor, reported in September 2025 that 64% of the AI bot traffic it saw reached forms, and that only 2.8% of the websites it tested were fully protected, down from 8.4% in 2024. That is a vendor's own data, so read it as a signal rather than a census.

Form outreach is sold openly. You do not need research to see this part. One contact-form outreach service describes its product as a platform that crawls each site, finds the contact form, fills every field, solves any CAPTCHA and submits, with AI writing a unique message per site. Its pitch to buyers is blunt: "There's no spam folder for contact forms."

Why the old tools cannot see it

Every anti-spam tool a contact form has available works on one of three signals, and the new mail defeats all three, mostly by accident rather than by design.

The words. Keyword lists catch vocabulary. This mail has the vocabulary of a normal business email, because it was produced by something trained on normal business emails. If each copy is reworded, as the Columbia study found, a list of phrases has nothing stable to match.

The sender. Blocklists and reputation services catch addresses and domains that have misbehaved before. On a form, the visitor types whatever address they like. And outreach software is built to spread sending across many accounts: one popular cold-email tool lets you assign unlimited accounts to a campaign and rotates between them "to make outreach appear more natural". By the time an address is on a list, the campaign has moved on.

The behaviour. Honeypots and timing checks catch automation that behaves like automation. CAPTCHAs were meant to catch the rest. A July 2026 preprint, Broken Gates, tested seven CAPTCHA-solving services and six AI browser agents against hCaptcha, reCAPTCHA v2, reCAPTCHA v3 and Cloudflare Turnstile. The solving services achieved near-perfect bypass of challenge-based CAPTCHAs, at costs as low as $0.10 per 1,000 solves. Score-based reCAPTCHA v3 held up better — the services averaged 23% success against it — but the authors found that this resistance came from spotting tell-tale signs in the bot's browser environment rather than anything about how it behaved, and they describe it as not a durable security property.

The same paper is honest about the other side: the off-the-shelf AI agents it tested generally failed the challenges unless a dedicated solver was plugged in. The point is not that every bot now beats every CAPTCHA. It is that anyone sending commercial volume can buy their way past one for less than the price of a coffee.

There is a fourth signal, and it is the one that has always worked: read the message and ask whether a person wrote it to you. That was never automatable, which is why nobody built on it. It is automatable now, by the same technology that caused the problem.

A note on the email rules

Cold email itself has become harder to send carelessly. Since 1 February 2024, Google has required everyone sending to Gmail accounts to authenticate their mail with SPF or DKIM. Anyone sending more than 5,000 messages a day to Gmail accounts must also set up DMARC, and their marketing messages must support one-click unsubscribe.

A contact form sits outside all of that: the message is delivered by your own website to your own mailbox. Whether those rules have pushed any outreach towards forms is not something we have seen measured, so treat this as background rather than explanation.

What this costs

The obvious cost is time. The real one is the enquiry you missed while deleting forty of these, or the one that went to a folder you check on Fridays.

Most businesses respond by tightening the form — adding a CAPTCHA, adding required fields, adding a question only a human could answer. Every one of those is a tax on the customer who is genuinely trying to reach you. A USENIX Security 2023 study in which 1,400 participants solved 14,000 CAPTCHAs found significant differences in how long different types take, and looked specifically at people who give up on a task when one appears. None of that friction touches the mail described above, because that mail passes every test a real customer passes.

The filter has to move off the form and onto the message.

What to keep, and what to stop

You do not need to rip everything out. The cheap layers still remove the crude end, and the crude end has not disappeared (the most common kinds of contact form spam are still with us).

Measure	Keep or stop	Why
Honeypot field	Keep	Invisible to customers, still catches simple scripts
Invisible, score-based CAPTCHA	Keep if it is already there	No friction for people; catches some automation
Visible puzzle CAPTCHA	Reconsider	Costs real customers time; solving services beat it cheaply
Growing keyword lists	Stop	Reworded mail avoids them, and they misfire on real enquiries
Extra required fields and quiz questions	Stop	Only the genuine customer finds them annoying
Blocking email domains one by one	Stop	The sender field is whatever the visitor typed

If you run WordPress, the Contact Form 7 spam guide covers the settings that are worth keeping, and CAPTCHA on contact forms goes into the trade-offs in more detail.

How to test a message-level filter safely

A filter that reads messages is making judgements, and judgements should be checked before they are trusted. The safe way to do that is a dry run.

Deliver everything. For the first two to four weeks, nothing is held. The filter only records what it would have held and why.
Read the would-have-held list. Every item. You are looking for one thing: a real enquiry that would have been stopped. One is enough to change the setting.
Read the delivered list too. Note the pitches that got through. That tells you whether the filter is too loose.
Adjust the threshold, not the rules. If it is holding real people, loosen it. If it is letting obvious outreach through, tighten it. Then run another week.
Only then switch to holding. And keep held mail somewhere you can find it, rather than deleting it.

This is how Humainbox works: each inbox can start in dry run, a language model reads each message and writes down its reason, and held mail stays in the panel where it can be released.

Where this is hard

A message-level filter is better at this problem than a rule, but it is not magic, and anyone selling it as magic is overselling.

Short genuine enquiries. "How much for a staircase?" contains no detail and no context. It is also a perfectly real customer. A filter that rewards detail has to be careful not to punish brevity.

Customers who use AI to write. A real person may ask a chatbot to tidy up their enquiry before sending it. Polished prose is evidence, not proof.

Unsolicited but legitimate. Press enquiries, recruiters with real vacancies, suppliers offering a trade account. They look like outreach because they are outreach. We cover these in what an AI SDR actually sends you.

The other side adapts. The Columbia authors leave open whether machine-written spam actually evades current detectors. Nobody should assume today's result holds next year, which is exactly why the reasoning behind each decision needs to stay visible.