Website platform
WordPress contact form spam: one field, no plugin
Check this is the field you mean. It is WordPress's own address — password resets, update failures, new user notices — and not your contact form's, which lives in whichever form plugin you use.
Covers the default site notifications. Most WordPress sites also use one of the form plugins below, and those have their own recipient field.
Replace whatever is in that field with the address Humainbox generates for you. Nothing else changes: no plugin, no snippet, no DNS record, and nothing on your site to republish. If you want to stop, put your old address back in that field.
Site Title
Your Company
Tagline
Just another WordPress site
Administration Email Address
change thisMembership
Anyone can register — off
Why it is getting through
What WordPress already stops — and where it stops
They arrive in the same shape. Your site ranks poorly and they noticed; they have a developer free from Monday; they can get you onto the first page. Each one is fluent, each one fills every required field correctly, and each one is addressed to the business name it lifted off your own homepage.
Akismet ships with WordPress and it is worth keeping on, but what it filters is comments and pingbacks. It sees a form submission only where the form plugin hands one over, and it judges largely on reputation: the sending address, the IP it came from, whether this text has turned up on other sites. A paragraph generated this morning and sent once, from an ordinary residential connection, has no reputation to judge.
What WordPress keeps either way
Nothing, by itself. WordPress core has no contact form, so whatever keeps a copy is your form plugin, and two of the popular ones keep none.
We check the message itself
A captcha asks whether the sender is a machine. We ask whether the writing could only have been sent to you.
Nothing is deleted
Held mail stays readable in the panel for your whole retention window, and one click sends it on.
If we break, your mail still arrives
If anything breaks on our side, mail goes through. You get the noise back for an afternoon; you never lose an enquiry.
Questions
WordPress, specifically
The ones that come up about this builder rather than about us. If yours is not here, ask it — a person answers.
Is this the same as the admin email in Settings → General?
No, and it is the mix-up worth settling before you change anything. Settings → General → Administration Email Address is where WordPress writes to itself: new registrations, password resets, a plugin update that failed. Your contact form does not use it. The address the form writes to lives in the form plugin — Mail → To in Contact Form 7, Settings → Notifications in WPForms and Gravity Forms.
I have Akismet. Why is this still getting through?
Akismet is a reputation filter and this mail has no reputation yet. It was written once, for you, from an address and an IP with no history, and it does not match text seen anywhere else because it does not exist anywhere else. That is the whole difficulty: the message is not a copy of a known spam, it is a new one.
Do I have to install anything?
No. No plugin, no snippet, no DNS record, nothing on your site to republish. You change one address in the settings panel you already have open, and if you want to stop you put the old address back in the same field.
Will my form plugin still save the submission?
That depends on the plugin and it is worth checking first. Plain Contact Form 7 stores nothing at all, and WPForms Lite stores nothing either, so the notification email is the only copy. Gravity Forms and paid WPForms both keep entries in your WordPress database whichever address the notification goes to. Where your plugin keeps nothing, held mail stays readable in the Humainbox panel for your whole retention window.
Does this change how my site sends mail?
No. WordPress still sends the notification exactly as it does today, through wp_mail and whatever SMTP plugin you use. The only thing that changes is who it is addressed to.
Not sure what is already running on your contact page? Paste it into the free check and we will name the builder, the CAPTCHA and what your DNS says. No account, nothing stored.
Cannot find it on your WordPress?
Menus move between versions, themes hide panels, and an agency may have built something on top of the standard one. Send us the address of your contact page and we will look at the install you have rather than the one this page was written about. A person reads it, and replies within a day.
And if the person who can change that field is not you, Humainbox writes to them instead — the field, the address, and nothing else to read.
Checked against WordPress’s own documentation
Using something else?
If a form can send its notification to an address you choose, it works, whether or not it is on this list.