Website platform
Webflow form spam: change the form's To field
On the form itself in the Designer, not in project settings — so each form moves separately. The To field takes a Workspace member from the dropdown or an address you type.
Replace whatever is in that field with the address Humainbox generates for you. Nothing else changes: no plugin, no snippet, no DNS record, and nothing on your site to republish. If you want to stop, put your old address back in that field.
To
change thisSender name
Your Company
Reply to
The email field on this form
Subject line
New form submission
Why it is getting through
What Webflow already stops — and where it stops
Webflow's own filter takes the crude attempts out before you see them, which changes what is left rather than how much of it there is. What reaches your inbox is the subset that looked entirely fine to a filter: real address, plausible name, correct fields, and a paragraph offering you a service you did not ask about.
Every Webflow submission is run through Cloudflare-based spam filtering, and what it flags goes to a spam tab you can review rather than to your inbox. You can add a reCAPTCHA field or Turnstile on top of it. All of that judges the sender — is this automated, does this address look disposable, does this connection have a history. It stops before the message.
What Webflow keeps either way
In Site settings → Forms, separately from your page content, whatever the notification says. On the free Starter plan that store is capped at 50 submissions for the life of the site, and once it is full new submissions stop being collected at all.
We check the message itself
A captcha asks whether the sender is a machine. We ask whether the writing could only have been sent to you.
Nothing is deleted
Held mail stays readable in the panel for your whole retention window, and one click sends it on.
If we break, your mail still arrives
If anything breaks on our side, mail goes through. You get the noise back for an afternoon; you never lose an enquiry.
Questions
Webflow, specifically
The ones that come up about this builder rather than about us. If yours is not here, ask it — a person answers.
Does this stop spam eating my 50 free submissions?
No, and it would be easy to imply otherwise here. Webflow records the submission before any notification is sent, so it counts against your plan's store whatever we do. What changes is your inbox. If the cap is the problem rather than the reading, a paid Site plan lifts it and we do not.
Where is the field? I cannot find it in project settings.
It is on the form itself. Select the form element in the Designer, open Form settings, and the Email Notifications block holds the To field — you can pick a Workspace member from the dropdown or type an address. Site settings → Forms holds the default that the panel's Reset to defaults button goes back to.
Can I keep my own address on it as well while I watch?
Yes. The To field takes more than one recipient, so you can add ours alongside yours for a week and compare what we held against what arrived. That is also what dry run does on our side without you touching the field twice.
Will submissions still show up in Webflow?
Yes, in the same place as now. The submissions list, the spam tab and the CSV export are all Webflow's own record and none of them depend on where the notification email went.
Not sure what is already running on your contact page? Paste it into the free check and we will name the builder, the CAPTCHA and what your DNS says. No account, nothing stored.
Cannot find it on your Webflow?
Menus move between versions, themes hide panels, and an agency may have built something on top of the standard one. Send us the address of your contact page and we will look at the install you have rather than the one this page was written about. A person reads it, and replies within a day.
And if the person who can change that field is not you, Humainbox writes to them instead — the field, the address, and nothing else to read.
Checked against Webflow’s own documentation
Using something else?
If a form can send its notification to an address you choose, it works, whether or not it is on this list.