Gravity Forms spam: change Send To Email
If the notification is set to "Select a Field", switch it to "Enter Email" and paste the address.
Replace whatever is in that field with the address Humainbox generates for you. Nothing else changes: no plugin, no snippet, no DNS record, and nothing on your site to republish. If you want to stop, put your old address back in that field.
What Gravity Forms already stops — and where it stops
Nothing in the entry looks wrong. The honeypot was left alone, the form took forty seconds to fill in, the address is real and the reply-to works. It is only the writing that gives it away, and by then it is already in your inbox.
The Gravity Forms honeypot has grown teeth: a hidden field, a site-specific hash inserted by JavaScript, state validation, and an optional check that flags a form completed faster than a person could type it. Every one of those asks how the form was filled in. None of them asks what was written — and what gets through is a real browser, at human speed, with the hidden field untouched.
What Gravity Forms keeps either way
In Forms → Entries, whatever address the notification goes to, unless the form is set not to save entries at all.
01
We check the message itself
A captcha asks whether the sender is a machine. We ask whether the writing could only have been sent to you.
02
Nothing is deleted
Held mail stays readable in the panel for your whole retention window, and one click sends it on.
03
If we break, your mail still arrives
If anything breaks on our side, mail goes through. You get the noise back for an afternoon; you never lose an enquiry.
Checked against Gravity Forms’s own documentation
Menu path last verified . If it has moved since, tell us and we will fix it.
Send To
Send To Email
Change ThisReply To
Subject
Questions
Gravity Forms, specifically
The ones that come up about this builder rather than about us. If yours is not here, ask and a person answers.
The honeypot and the submission speed check are both on. How is this getting through?
Because it is not being submitted by a script. Those checks catch a program posting to your form — no JavaScript, no state, filled in a quarter of a second. What you are getting is a browser, at typing speed, with the hidden field left alone, carrying a paragraph a model wrote. Every mechanical signal is clean; the only thing wrong with it is the content.
My notification is set to "Select a Field". What do I do?
Switch it to Enter Email and paste the address in. Routing to a field means the notification goes wherever the submitter's own data sends it, which is not a thing you want to leave in a stranger's hands in either case.
Can I add it alongside my own address rather than replacing it?
You can — Send To Email takes a comma-separated list — and for a week it is a reasonable thing to do: you see both what we held and what we let through, against the same submissions. It is also what dry run does on our side without you touching the field twice.
Will my entries and conditional notification routing still work?
Yes to both. The entry is written when the form is submitted, before any notification goes out. Conditional logic on a notification decides whether that notification fires at all, which is a separate decision from the address it is fired to.
Not sure what is already running on your contact page? Paste it into the free check and we will name the builder, the CAPTCHA and what your DNS says. No account, and no email asked for.
Cannot find it on your Gravity Forms?
Menus move between versions, themes hide panels, and an agency may have built something on top of the standard one. Send us the address of your contact page and we will look at the install you have rather than the one this page was written about. A person reads it, and replies within a day.
Using something else?
If a form can send its notification to an address you choose, it works, whether or not it is on this list.
