Form builder
Runs on WordPressWPForms spam: change Send To Email Address
Set per form, so you can move one form across and leave the rest alone while you watch it.
Replace whatever is in that field with the address Humainbox generates for you. Nothing else changes: no plugin, no snippet, no DNS record, and nothing on your site to republish. If you want to stop, put your old address back in that field.
Settings → Notifications
Send To Email Address
change thisEmail Subject Line
New Entry: Contact Form
From Name
{field_id="1"}
Reply-To
{field_id="2"}
Why it is getting through
What WPForms already stops — and where it stops
You turned the anti-spam token on, and the volume dropped, and then it came back looking different: correctly filled, plausibly worded, a real name, a working address, and an offer you have now had from six companies you have never heard of.
WPForms ships more anti-spam than most, and all of it is worth keeping: a token proving the form was rendered by a browser, a honeypot, Akismet, a country filter, and allow and deny keyword lists. But a token and a honeypot answer how the form was filled in, and this was filled in by a browser. A country filter answers where from, and this comes from anywhere. A keyword list answers which words — and generated text does not reuse words, because every message is written fresh.
What WPForms keeps either way
On a paid licence, in WPForms → Entries, whatever address the notification goes to. WPForms Lite stores no entries at all unless Lite Connect is switched on, which makes the notification email the only copy.
We check the message itself
A captcha asks whether the sender is a machine. We ask whether the writing could only have been sent to you.
Nothing is deleted
Held mail stays readable in the panel for your whole retention window, and one click sends it on.
If we break, your mail still arrives
If anything breaks on our side, mail goes through. You get the noise back for an afternoon; you never lose an enquiry.
Questions
WPForms, specifically
The ones that come up about this builder rather than about us. If yours is not here, ask it — a person answers.
The anti-spam token and honeypot are on. How is this arriving?
Because neither of them is aimed at this. A token proves a browser rendered the form; a honeypot catches something that fills in a field a person cannot see. Both are true of an ordinary browser, and this is being sent from one. What neither asks is whether the paragraph in the message box could have been written to anybody.
Can I move one form and leave the rest alone?
Yes, and it is the sensible way to start. The Send To Email Address sits in each form's own notification, so you can move your busiest form across, watch it for a week, and leave every other form untouched.
Will my entries still be there?
On a paid licence, yes — entries are written to your WordPress database when the form is submitted, which happens before any notification is sent, so the address on the notification does not touch them. On WPForms Lite there are no entries to begin with unless you have Lite Connect on, and there the held mail in the Humainbox panel is your copy.
Does this change the confirmation the visitor sees?
No. Confirmations are configured separately from notifications and are shown to the person who submitted the form. Nothing about their side of it changes.
Do I need WPForms Pro for this?
No. The notification recipient field is in the free version as well, and it is the only field you change.
Not sure what is already running on your contact page? Paste it into the free check and we will name the builder, the CAPTCHA and what your DNS says. No account, nothing stored.
Cannot find it on your WPForms?
Menus move between versions, themes hide panels, and an agency may have built something on top of the standard one. Send us the address of your contact page and we will look at the install you have rather than the one this page was written about. A person reads it, and replies within a day.
And if the person who can change that field is not you, Humainbox writes to them instead — the field, the address, and nothing else to read.
Using something else?
If a form can send its notification to an address you choose, it works, whether or not it is on this list.
