Notes from the spam folder.

Email filters were trained on twenty years of inbox junk. The junk that arrives through a website form looks different, behaves differently, and has different tells.

The oldest trick in form protection catches more bots than any model we run, for free. Here is how to do it properly and where it fails.

A number between 0 and 1 tells you how sure a model is. It does not tell you what to do. Codes do.

Sharing what one site learns with every other site is the strongest signal in spam filtering, and the easiest to abuse. How spamex does it with decay, hashing and a two-site rule.

The API tells you spam or ham and why. The part that decides whether your customers notice is what your code does next. A policy that has held up across many forms.

Spam filters are usually judged by how much junk they catch. For a contact form the metric that matters is the opposite one.

A walkthrough for form backends and builders: one platform key, a key per customer form, one call before delivery, and a button your customers will thank you for.

The thirty-odd genres of junk that arrive through a website form, from the obvious to the ones that fool people.

Every puzzle you put in front of a visitor costs you some of them. Here is what it costs, who pays it, and what to do instead.

A spam filter needs memory to work. It does not need your visitors' messages. How the storage is designed so the default is privacy.