How SpamKill Works

Invisible to humans.
Impossible for bots.

SpamKill transforms your forms at the DNA level — randomizing fields, injecting intelligent honeypots, analyzing behavioral signals — all without your visitors ever knowing.

See It In Action ↓ Find Your Solution
5 min
Setup time
0
UX friction
99.9%
Accuracy
Real-time
Processing

And afterward? See everything the console reports →

The core concept

One form. Two realities.

When you install SpamKill, every form on your site gets a dual identity. Real visitors see your normal form. Bots see a transformed version designed to trap and identify them.

What Your Visitors See
Full Name
Jane Smith
Email Address
Phone
(604) 555-0123
Message
I'd like to learn more about your services...
Submit ✓ — Clean lead delivered
VS
What Bots See
sk_x9K_trap_A7q TRAP
sk_6Lin8xq5ZhRd9E
email HONEYPOT
credit_card HONEYPOT
sk_MSMvop3jEH7Iu
bot_detect_R3m TRAP
⛔ Blocked — Bot signature detected

Your visitors see their normal form — no CAPTCHAs, no puzzles, no extra steps. Meanwhile, bots encounter randomized field names, decoy honeypot fields, and encrypted attributes that make automated submission impossible.

What happens to each submission

Every submission gets scored. Real people always get a way through.

Unlike tools that reject suspicious submissions outright, SpamKill challenges the visitor first — and depending on your plan you can audit what was blocked.

📥
Submission received
SpamKill intercepts the form submission, decrypts behavioral signals, checks honeypot fields, and runs multi-category AI scoring — all in real time, before the submission completes.
Every submission
Pass
Score is clean. Submission forwarded immediately to your original endpoint.
⚠️
Quarantine
Score is suspicious. The visitor gets a verification challenge; blocked leads are reviewable depending on plan.
🎯
Your CRM gets clean data
Approved submissions are reconstructed with original field names and hidden values, then forwarded to your backend in the exact format it expects. Zero changes required.
Zero backend changes
The science

Three layers of protection working together

Each layer catches what the others miss. Together, they achieve 99.9% accuracy.

Dynamic Form Transformation

Every form is dynamically transformed with multiple layers of obfuscation. Field names get randomized, hidden fields get encrypted and extracted, and decoy elements are injected at unpredictable positions.

🔀
Field name randomization — Original names like "email" become cryptographic strings like "sk_6Lin8xq5ZhRd9E". Mapping is stored encrypted and restored server-side.
🍯
Dual honeypot strategy — Attractive names ("email", "credit_card") lure bots, while pattern-matching names ("sk_ej84jy6g") catch bots that try to fill all similarly-named fields.
🔒
Hidden field extraction — CSRF tokens, session IDs, and backend metadata are extracted, encrypted, and stored server-side. Bots can't see or replicate them.
🔄
Per-session regeneration — In dynamic mode, every session gets a unique form layout. Knowledge from analyzing one session doesn't transfer to the next.
TRANSFORMATION EXAMPLE
ORIGINAL FORM
<form action="/submit">
  <input name="email"/>
  <input name="first_name"/>
  <input type="hidden" name="csrf"/>
</form>
↓ SpamKill transforms ↓
PROTECTED FORM
<form action="https://protect.spamkill...">
  <input name="sk_6Lin8xq5Zh"/>
  <input name="email" style="display:none"/> ← honeypot
  <input name="sk_MSMvop3jEH"/>
  <input name="credit_card" style="display:none"/> ← honeypot
  <script src="spamkill/sk.js"></script>
</form>
Choose your path

Three ways to install. All take minutes.

Pick whichever fits your setup. No backend changes required for any option.

🔌
WordPress Plugin
One-click install, automatic protection
⚡ 5 minutes
  • Install from WordPress plugin directory
  • Protects all forms automatically
  • Works with Gravity Forms, CF7, WPForms, Elementor, Divi, and more
  • Also protects WordPress comments and WooCommerce reviews
Install Plugin →
🔀
HTML Transformer
Paste your CRM's form code, get protected code back
⚡ 5 minutes
  • Web-based converter in your SpamKill dashboard
  • Paste your CRM's HTML form code in, get protected code out
  • Works with Keap, ActiveCampaign, HubSpot, Salesforce, ClickFunnels, Kajabi, and any platform with HTML forms
  • No backend changes needed
Try the Transformer →
📝
SpamKill Form Builder
Built-in forms for non-HTML platforms
⚡ 5 minutes
  • Build protected forms in SpamKill's dashboard
  • Connects directly to your CRM
  • For platforms that don't provide HTML form code
  • Supports GoHighLevel and Kit/ConvertKit
Build a Form →
The quarantine system

A false flag doesn't cost you the lead.

Most spam tools make binary accept/reject decisions — if they're wrong, the lead is gone forever. SpamKill challenges the visitor instead: a real person verifies in one step and comes through, and depending on your plan, an owner audit sits on top.

1

Submission flagged

Behavioral scoring identifies a suspicious submission. Instead of rejecting, it goes to quarantine.

2

User gets a verification challenge

The visitor can verify via WebAuthn biometrics, social login, or re-entering a field value. Not a CAPTCHA — it's identity verification tied to their specific submission.

3

Verified? Lead recovered.

If the user passes verification, the submission is released from quarantine and forwarded to your backend in the original format. If they don't attempt it, the submission is blocked — and depending on your plan, you can audit it and flag a false positive.

Why this matters
reCAPTCHA / Cloudflare
Binary decision. If it's wrong, the lead is permanently lost. No way to review or recover.
SpamKill
Suspicious submissions are challenged, not rejected. The visitor can self-verify in one step. Plans with blocked-lead review add a full owner audit.

For lead generation, every potential customer has value. Silent rejection is unacceptable — a challenge the real person can pass is the only responsible default.

Works with everything

Any form. Any platform. Any CRM.

WordPress plugin, HTML transformer, or built-in form builder. Three paths to protection. Zero backend changes.

WordPress
Gravity Forms
Contact Form 7
WPForms
Elementor
HubSpot
Salesforce
ActiveCampaign
Keap
ClickFunnels
Kajabi
GoHighLevel
See all integrations →
Ready to start?

Pick your path

Different businesses need different onboarding. Choose the one that fits.

Common questions

How it works, in practice

No. The analysis runs asynchronously alongside your form, so visitors never wait on it — there is no puzzle to render and nothing visible to load.

SpamKill is 100% accessible. The obfuscation only affects bots — screen readers and assistive technologies work normally.

SpamKill's AI-powered system continuously evolves. The obfuscation patterns and detection methods update automatically to stay ahead of new bot techniques.

With 99.9% accuracy, false positives are extremely rare. When we are unsure about a real person, they get one quick verification step and continue — a false flag never turns a real person away outright. Depending on your plan, you can also audit everything that was blocked.

Simple enough for a solopreneur.
Powerful enough for enterprise.

Five minutes to install. 99.9% accuracy. Zero impact on your visitors. That's the SpamKill promise.

Find Your Solution Our Story →