Humainbox: A Filter That Stops AI Spam on Contact Forms

Spam that reads like a customer

Contact form spam is now written by AI. It names the business, sounds plausible and passes captchas, so someone has to open every message to find out it is junk.

The sender tells you nothing

Form notifications all come from the site's own server and address. Filters that judge the sender have nothing to work with, so the decision has to rest on what the message says.

Filters are hard to install and harder to trust

Most anti-spam tools need a plugin, a script or a developer, often on a site nobody wants to touch. And the fear of losing a real enquiry stops many businesses from filtering at all.

One field is the whole install

Each form gets its own generated address on in.humainbox.com. The owner pastes it into the form's notification settings, and nothing on the site changes. Integration pages show the exact field in WordPress, WPForms, Contact Form 7, Gravity Forms, Elementor, Webflow, Squarespace, Shopify, Wix, HubSpot and Typeform. For WordPress sites with many forms, an optional free plugin on WordPress.org changes that field on every form in one go. It keeps the old address so it can be put back.

Judged on the message, with reasons

Rules score every message first. When they cannot decide, the text goes to an OpenAI language model (an AI that reads text). Each workspace can turn this step off. Every decision is saved with the signals that matched and how much each one counted. Corrections are saved for each inbox, so repeat campaigns are caught.

Built so nothing real is lost

Held messages are never deleted and can be released in one click. Each inbox has its own strictness level. If the filter cannot reach a decision, the message is delivered. Every inbox starts with a dry run, a test week that delivers everything and lists what would have been held.

Routing and the reply address

Real enquiries go to a named person or a team, and each gets their own copy. The copy carries the visitor's real reply address, taken from the message or the Reply-To header. Agencies get separate workspaces per client that cannot see each other.