How ShipMyForm Fights Form Spam (So You Never Have To)

Put a form on the public internet and it will be found. Not eventually — quickly, and not by people. Crawlers hunt for <form> tags the way they hunt for unprotected databases, and once your endpoint is on a list, the junk arrives on schedule: SEO solicitations, prize scams, "partnership opportunities" from addresses that have never read your site, and wave after wave of pure bot noise.

Most of the industry answers this with a trade that has quietly become normal: make every human prove their innocence so the bots stay out. We think that trade is backwards. This is the story of how ShipMyForm fights spam instead — and why your visitors will never see any of it.

The CAPTCHA tax

CAPTCHAs work, roughly. They also bill the wrong party. Every crosswalk you ask a real customer to identify is a small toll on the person you most wanted to hear from — and some percentage of them, on a phone, in a hurry, simply leave. You'll never see that in a spam report, because the report only counts the junk you blocked, never the lead you lost.

The math that matters for a contact form isn't how much spam got stopped. It's how many real messages arrived. A defense that costs you a single genuine customer to block a hundred bots is a bad deal, because the bots were never going to buy anything anyway.

So we set a constraint that shapes everything else: the person filling in your form should never do any work, see any puzzle, or feel any friction because spammers exist. Spam is our problem. We took the job.

Defense in layers, not in one clever trick

There's no single test that separates a bot from a human, because spam isn't one thing. Automated junk behaves differently from human-written cold solicitation, which behaves differently from a targeted flood. A defense built on one trick — any one trick — is a defense with one thing to route around.

So every submission runs a gauntlet instead:

• Invisible tripwires catch the crude majority. Bots reveal themselves mechanically — filling fields no human can see, submitting faster than a page can be read, hammering endpoints at inhuman rates. This tier costs real visitors nothing and dispatches most junk before anything smarter needs to wake up.
• A trained filter reads what's left. Messages that pass the mechanical checks get scored the way a seasoned inbox reads mail — sender signals, content patterns, the fingerprints of campaigns it has seen before. Confident verdicts, in either direction, are settled on the spot.
• The genuinely ambiguous get a second opinion. Some messages are hard calls even for a human — the "partnership inquiry" that might be real, the terse one-liner with no context. Rather than coin-flip, the hard cases get reviewed with more scrutiny before anything reaches your inbox or your integrations.

And the system doesn't stand still. When you mark a message as spam — or rescue one that isn't — that verdict feeds back into the filtering. Your form's defense gets more personal over time, tuned by the only judge whose opinion matters: you.

Designed for the attack you haven't had yet

Two decisions in this system exist purely to protect you on your worst day.

Blocked spam never touches your quota. On plans with a monthly submission limit, a spam flood could otherwise become a denial-of-service on your own pricing — burn the quota, silence the form, and the attack wins twice. So junk we stop simply doesn't count. Your allowance is for the messages you actually wanted.

Judgment calls are set aside, not deleted. Anything short of certain goes to the form's spam folder with the reasons attached, where one click restores it. We'd rather show you an occasional false alarm than silently delete the customer you waited all month for. Confidence is not a reason to destroy evidence.

What this looks like from your side

Nothing. That's the product.

Your form stays exactly the HTML you wrote. Your visitors type a message and press send, with no puzzles in the way. Your inbox receives mail from humans. Your Slack and your spreadsheet stay clean, because filtering happens before delivery, not after — a spam message that reaches five integrations is five messes to clean instead of zero. And on the rare occasion something lands in the spam folder wrongly, you click once, it comes back, and the system remembers.

The best spam defense isn't a feature you configure. It's a distant hum of something being handled — visible only in the quiet.

Try it against your own spam

If your current form is drowning — or your CAPTCHA is costing you leads you can't count — point your form at ShipMyForm and watch what the spam folder catches in the first week. The free plan includes the full defense: every layer, every form, no configuration. Spam protection is not an upsell here, because a form backend that only protects paying customers isn't really in the spam-fighting business.

Curious about the wider techniques and the reasoning behind them? Read how to stop form spam without reCAPTCHA, or start with what a form backend does.