Spam protection

What’s already covered?

MailContact limits repeated messages and unusually high sending volumes. It also rejects messages with a missing or invalid email address, an empty message or too much text.

Rejected submissions don’t appear in your inbox or use your monthly allowance.

Add a hidden bot trap

Our script injects a hidden field automatically when it initializes a form. Visitors don’t see it or need to fill it in. At submission, the field must still be present and empty. A missing field blocks sending with an error; a filled field is silently discarded.

A bot that inspects the HTML can recognize and skip this field. It catches basic automated submissions; it does not establish that someone is human. Server-side checks and automatic verification remain active even when the field is empty. Keep the accessibility attributes so the trap does not interfere with real visitors.

If the trap is filled, our script discards the submission locally with the usual confirmation, before fetching settings or posting the message. This saves an unnecessary API request. Direct HTTP submissions are still checked independently by the server.

For a custom interface, call MailContact.prepare(form) once before the visitor interacts, then send its FormData with MailContact.send(). Direct API integrations and forms without JavaScript must include the field themselves, as shown below.

Review the Spam folder

Strong spam signals, obvious money promotions and repeated campaigns go to Spam for 30 days. They do not send notifications or use your message allowance. Inbox owners and collaborators can restore a legitimate message; restoration delivers and counts it normally.

Automatic browser verification

Some suspicious submissions need a short automatic browser check. There are no pictures to solve or new accounts to create. Our generated forms include MailContact’s hosted script, which completes the check and resends the preserved message automatically. The check increases the cost of automation; it does not prove a visitor is human.

Custom JavaScript integrations can opt in to automatic verification and handle the CHALLENGE_REQUIRED response. They must include the required hidden check; suspicious submissions without verification support go to Spam for review. Native HTML forms open a verification page when needed. A visitor without JavaScript can still send ordinary submissions; if verification is required, the page preserves their text and offers to send it for manual review.

Can spam still get through?

Yes. These checks reduce abuse and can sometimes flag a legitimate message. A link or a Gmail address alone is never enough to classify a message as spam. Check your Spam folder occasionally.

If you’re receiving a lot of spam, contact us with an example.

<form action="https://mailcontact.app/api/forms/your-form-id" method="POST">
  <input type="email" name="email" placeholder="[email protected]" required />
  <textarea name="message" placeholder="Your message" required></textarea>

  <div class="hp" aria-hidden="true">
    <label>
      Website
      <input type="text" name="company_website" tabindex="-1" autocomplete="off" />
    </label>
  </div>

  <button type="submit">Send</button>
</form>

<style>
  .hp {
    position: absolute;
    left: -9999px;
    width: 1px;
    height: 1px;
    overflow: hidden;
  }
</style>