Blog
Contact forms started receiving mail that reads like a person wrote it, because something wrote it to read that way. These are notes on what changed, why the filters everyone already had stopped catching it, and what actually helps.
Contact form spam used to announce itself. Now it references your work and asks for fifteen minutes. What changed, what the research shows, and how to filter it without losing enquiries.
HumainboxFour patterns that show up in almost every machine-written sales approach, the three things a real enquiry does that none of them manage, and what to do when one lands in your form.
HumainboxEverything else
When junk submissions fire your conversion tag, the bidding learns from them and buys more of the same traffic. Why a mailbox filter cannot fix that, and what actually can.
HumainboxEvery client asks why the contact form is full of spam again. A playbook for agencies: inventory the forms, standardise the basics, agree a threshold per client and put it in the retainer.
HumainboxFiltering contact form spam means reading personal data. What GDPR asks of you: a lawful basis, short retention, a line in your privacy notice, and care with providers and AI models.
HumainboxA spam filter can be 99% accurate and still hold one real enquiry in ten. How to work out what those misses cost you, and how to measure a filter before you trust it.
HumainboxFake copyright complaints sent through website contact forms have been used to deliver malware since at least 2021. How the lure works, how to spot one, and what to do instead of clicking.
HumainboxA shared info@ address feels safe and quietly loses enquiries. How to route each contact form to a named owner, cover absences and leavers, and keep fewer copies of personal data.
HumainboxSEO offers, "errors on your website", guest posts, fake invoices, legal threats: a field guide to the contact form spam you keep getting, the tell for each, and what a real one looks like.
HumainboxYour visitor did not send that email — your web server did. What wp_mail actually does, what SPF, DKIM and DMARC check on the way in, and why a form's “sent” does not mean delivered.
HumainboxA CAPTCHA checks whether a visitor is human, not whether they wrote to you. What reCAPTCHA, hCaptcha and Turnstile do now, what they cost real visitors, and when they are worth it.
HumainboxChange one setting in your contact form. Spam stops arriving, and real enquiries go to whoever should answer them. Try it for a week with nothing switched on.
We would like to count visits with Google Analytics, which sets two cookies. Decline and nothing is loaded and nothing is sent. What these are.
