SpamKill transforms your forms at the DNA level — randomizing fields, injecting intelligent honeypots, analyzing behavioral signals — all without your visitors ever knowing.
When you install SpamKill, every form on your site gets a dual identity. Real visitors see your normal form. Bots see a transformed version designed to trap and identify them.
Your visitors see their normal form — no CAPTCHAs, no puzzles, no extra steps. Meanwhile, bots encounter randomized field names, decoy honeypot fields, and encrypted attributes that make automated submission impossible.
Unlike tools that reject suspicious submissions outright, SpamKill challenges the visitor first — and depending on your plan you can audit what was blocked.
Each layer catches what the others miss. Together, they achieve 99.9% accuracy.
Every form is dynamically transformed with multiple layers of obfuscation. Field names get randomized, hidden fields get encrypted and extracted, and decoy elements are injected at unpredictable positions.
Pick whichever fits your setup. No backend changes required for any option.
Most spam tools make binary accept/reject decisions — if they're wrong, the lead is gone forever. SpamKill challenges the visitor instead: a real person verifies in one step and comes through, and depending on your plan, an owner audit sits on top.
Behavioral scoring identifies a suspicious submission. Instead of rejecting, it goes to quarantine.
The visitor can verify via WebAuthn biometrics, social login, or re-entering a field value. Not a CAPTCHA — it's identity verification tied to their specific submission.
If the user passes verification, the submission is released from quarantine and forwarded to your backend in the original format. If they don't attempt it, the submission is blocked — and depending on your plan, you can audit it and flag a false positive.
For lead generation, every potential customer has value. Silent rejection is unacceptable — a challenge the real person can pass is the only responsible default.
The check reads the submission — a filter can't judge what it can't see. What happens next depends on the verdict.
Blocked leads
Sealed the moment we block them.
Locked with a key only your passphrase can open. Decrypted only in your browser — your passphrase never leaves your device. Auto-deleted after 31 days; no copies, no backups.
The full architecture →Allowed submissions
Delivered to your CRM, in the original format.
Pipeline stage, UTMs and hidden fields intact — and not retained by us. What we store is what we blocked.
The infrastructure behind it
Built to stay up.
Deployed on AWS across multiple availability zones, behind a load balancer, with multiple instances running at all times.
Our uptime commitment →One statement of retention, used on this page, on /security and in the DPA.
WordPress plugin, HTML transformer, or built-in form builder. Three paths to protection. Zero backend changes.
Different businesses need different onboarding. Choose the one that fits.
No. The analysis runs asynchronously alongside your form, so visitors never wait on it — there is no puzzle to render and nothing visible to load.
SpamKill has no challenge for anyone to fail: nothing to see, hear or solve. The W3C, which publishes WCAG, says every type of CAPTCHA will be unsolvable by users with certain disabilities, which is the barrier this removes. The obfuscation targets automated parsers, not assistive technology. If we are unsure about a visitor, they verify in one step, and a skipped step means a held submission you can review, not a lost one.
Yes. Detection is language-agnostic: it scores how the form was filled, not the words typed, so a lead in Portuguese, Thai or Japanese gets the same verdict as one in English, and nothing is blocked for its language or alphabet. If we are unsure about a visitor, the one-step verification is available in 13 languages: English, French, Spanish (Latin America), Portuguese (Brazil), Italian, Indonesian, Turkish, Russian, Ukrainian, Japanese, Chinese (Simplified), Korean and Thai. Visitors in any other language see it in English.
SpamKill's AI-powered system continuously evolves. The obfuscation patterns and detection methods update automatically to stay ahead of new bot techniques.
With 99.9% accuracy, false positives are extremely rare. When we are unsure about a real person, they get one quick verification step and continue — a false flag never turns a real person away outright. Depending on your plan, you can also audit everything that was blocked.
Five minutes to install. 99.9% accuracy. Zero impact on your visitors. That's the SpamKill promise.