Form builder
Runs on WordPressElementor form spam: change the Email action To field
Elementor Pro only — the free version has no form widget. Nothing here catches spam by default: the honeypot and reCAPTCHA are fields you add yourself.
Replace whatever is in that field with the address Humainbox generates for you. Nothing else changes: no plugin, no snippet, no DNS record, and nothing on your site to republish. If you want to stop, put your old address back in that field.
To
change thisSubject
New message from Your Company
Message
[all-fields]
From Email
Why it is getting through
What Elementor Forms already stops — and where it stops
An Elementor form goes live with nothing guarding it, because nothing is switched on to begin with, and the address in the To field is usually still the WordPress admin address that was there when the widget was dropped in. The first few weeks are quiet. Then the form is found, and it is found by everybody at once.
None, until you add some. Elementor's honeypot is a field type you add under Form Fields, and reCAPTCHA needs you to register your own keys with Google under Elementor → Settings → Integrations before you can put the field on the form. Both are worth doing. Both ask whether a script filled the form in, which stops being the question the moment the sender is a person in a browser.
What Elementor Forms keeps either way
In Elementor → Submissions, on the Advanced plan and above. On Essential Pro there is no submissions log at all, which makes the notification email the only copy.
We check the message itself
A captcha asks whether the sender is a machine. We ask whether the writing could only have been sent to you.
Nothing is deleted
Held mail stays readable in the panel for your whole retention window, and one click sends it on.
If we break, your mail still arrives
If anything breaks on our side, mail goes through. You get the noise back for an afternoon; you never lose an enquiry.
Questions
Elementor Forms, specifically
The ones that come up about this builder rather than about us. If yours is not here, ask it — a person answers.
I added the honeypot and reCAPTCHA v3. Why is this still arriving?
Because they are aimed at the sender, not the message. A honeypot catches something that fills in a field a person cannot see; reCAPTCHA v3 returns a score for how human the session looked. A browser driven by a person, pasting in a paragraph a model wrote, leaves the hidden field alone and scores like a person, because half of it is one.
Where exactly is the field?
Edit the page in Elementor, select the Form widget, and in the Content tab open Actions After Submit. Email is active by default; expand it and the To field is the first one. It usually still holds your WordPress admin address.
Will my submissions still be recorded?
If your Elementor Pro plan includes the Submissions log, yes — the entry is written when the form is submitted, before the Email action runs, so the address on that action does not touch it. On Essential Pro there is no log to begin with, and held mail in the Humainbox panel is your copy.
Does this affect the other Actions After Submit?
No. Redirect, Webhook, MailChimp, anything else you have chained after the submit runs exactly as it does now. You are changing one field inside one of those actions.
Not sure what is already running on your contact page? Paste it into the free check and we will name the builder, the CAPTCHA and what your DNS says. No account, nothing stored.
Cannot find it on your Elementor Forms?
Menus move between versions, themes hide panels, and an agency may have built something on top of the standard one. Send us the address of your contact page and we will look at the install you have rather than the one this page was written about. A person reads it, and replies within a day.
And if the person who can change that field is not you, Humainbox writes to them instead — the field, the address, and nothing else to read.
Checked against Elementor Forms’s own documentation
Using something else?
If a form can send its notification to an address you choose, it works, whether or not it is on this list.
