Common problem
If you are opening every message to work out whether it is real, the spam is doing its job. A growing share of it is drafted by a model now, so it has your town in it, a sentence about your work and a plausible ask. Nothing about how it was submitted gives it away — only what it says does.
Work down the list. Each one takes less time than the one after it, and you can stop as soon as something matches.
Nothing on your site broke and you did not start attracting a worse class of sender. Writing a plausible, specific, personalised message used to cost somebody several minutes, which is what made volume and quality mutually exclusive. That cost went to roughly zero, and the two stopped being a trade-off. Your form is the same form; the economics on the other side of it are not.
42%
of the WordPress contact pages we could read carry a CAPTCHA — and a CAPTCHA has nothing to say about a message a person, or a browser impersonating one, typed normally. It tests the submission, not the sentence.
From our study of 598 contact pagesThe exact menu path, per builder, with the field named.
Our free check reads your contact page and tells you what it finds. No account, nothing installed, and nothing on your site changes.
No, and be wary of anything claiming otherwise — detectors that promise to identify machine-written text are unreliable enough that schools have stopped relying on them. That is why the question worth asking is not “did software write this” but “is this a real enquiry”, which is answerable from what is being asked and what is being claimed.
Quite a lot of them, and it makes no difference to the decision. A person pasting a generated pitch into your form is sending you the same message for the same reason. Judging the content rather than the sender is what makes that distinction stop mattering.
It is the right worry and the honest answer is that any filter can be wrong. What matters is whether you find out: a CAPTCHA’s mistakes leave no record and no name, while a held message stays in a list with the reason it was held. Start in dry run — a week where nothing is held at all and you simply read what would have been.
SEO offers, "errors on your website", guest posts, fake invoices, legal threats: a field guide to the contact form spam you keep getting, the tell for each, and what a real one looks like.
HumainboxFour patterns that show up in almost every machine-written sales approach, the three things a real enquiry does that none of them manage, and what to do when one lands in your form.
HumainboxContact form spam used to announce itself. Now it references your work and asks for fifteen minutes. What changed, what the research shows, and how to filter it without losing enquiries.
HumainboxWe would like to count visits with Google Analytics, which sets two cookies. Decline and nothing is loaded and nothing is sent. What these are.
