Contact-form spam is not email spam, and your filter should know the difference
Email filters were trained on twenty years of inbox junk. The junk that arrives through a website form looks different, behaves differently, and has different tells.
Every spam filter you have used was built for email: decades of work on what a junk message looks like once it lands in an inbox. It is tempting to point one of those at a contact form. It will be fine on the emails and mediocre on the forms.
Different senders, different economics
Email spam is broadcast: one message to millions of addresses, so the text is optimised for volume and the sender does not know who you are. Contact-form spam is targeted at a page. The bot has already loaded your site, found the form, and often read the title. The pitch is about your website: “I noticed spamex.dev is not ranking on page one”, “your site has 14 errors”, “we can redesign your homepage”. It is personalised by machine, which makes it look, superficially, like a human wrote it.
The economics differ too. Email spam is nearly free to send, so it is sloppy. Form spam costs a little more (a headless browser, a proxy, a CAPTCHA-solving service), so it is aimed at higher-value targets: businesses with a public address and a person who reads the inbox.
Different tells
The signals that separate form spam from real inquiries are mostly not in the text:
- The honeypot. A hidden field a human never sees. Bots fill it anyway because they fill everything. This single check catches a large fraction of automated submissions and costs nothing.
- Time to submit. A person takes ten seconds to a few minutes. A bot posts in 200 ms.
- Identity mismatch. “Mike Anderson” from
[email protected]. A random-looking local part likexk93jdq21. A disposable domain. - Script mismatch. Cyrillic text submitted to a plumber in Ohio.
- Sender history. The same email address pitching backlinks to forty sites this week.
Only after those do we look at the words, and even then the vocabulary is its own dialect: “quick question”, “I was checking your website”, “guest post”, “DA50+”, “free audit”, “reply to this email”.
Different costs of error
An inbox filter that loses one real email among thousands is annoying. A contact-form filter that loses one real inquiry has lost a customer who will not try again. The false-positive budget is smaller, and the classifier has to be tuned for precision on legitimate messages first and recall second.
That is why spamex is built the way it is: cheap, deterministic signals first, a classifier that only decides alone when it is sure, and a second opinion for the residue. The numbers on the home page are measured on held-out contact-form submissions, and we update them with every release.