How SpamKill Works

Invisible to humans.
Impossible for bots.

SpamKill transforms your forms at the DNA level — randomizing fields, injecting intelligent honeypots, analyzing behavioral signals — all without your visitors ever knowing.

See It In Action ↓ Find Your Solution
5 min
Setup time
0
UX friction
99.9%
Accuracy
<50ms
Latency
The core concept

One form. Two realities.

When you install SpamKill, every form on your site gets a dual identity. Real visitors see your normal form. Bots see a transformed version designed to trap and identify them.

What Your Visitors See
Full Name
Jane Smith
Email Address
Phone
(604) 555-0123
Message
I'd like to learn more about your services...
Submit ✓ — Clean lead delivered
VS
What Bots See
sk_x9K_trap_A7q TRAP
sk_6Lin8xq5ZhRd9E
email HONEYPOT
credit_card HONEYPOT
sk_MSMvop3jEH7Iu
bot_detect_R3m TRAP
⛔ Blocked — Bot signature detected

Your visitors see their normal form — no CAPTCHAs, no puzzles, no extra steps. Meanwhile, bots encounter randomized field names, decoy honeypot fields, and encrypted attributes that make automated submission impossible.

What happens to each submission

Every submission gets scored. None get lost.

Unlike tools that permanently reject suspicious submissions, SpamKill's quarantine system preserves everything for review.

📥
Submission received
SpamKill intercepts the form submission, decrypts behavioral signals, checks honeypot fields, and runs multi-category AI scoring — all in under 50ms.
Every submission
Pass
Score is clean. Submission forwarded immediately to your original endpoint.
⚠️
Quarantine
Score is suspicious. Held for verification challenge or manual review.
🎯
Your CRM gets clean data
Approved submissions are reconstructed with original field names and hidden values, then forwarded to your backend in the exact format it expects. Zero changes required.
Zero backend changes
The science

Three layers of protection working together

Each layer catches what the others miss. Together, they achieve 99.9% accuracy.

Dynamic Form Transformation

Every form is dynamically transformed with multiple layers of obfuscation. Field names get randomized, hidden fields get encrypted and extracted, and decoy elements are injected at unpredictable positions.

🔀
Field name randomization — Original names like "email" become cryptographic strings like "sk_6Lin8xq5ZhRd9E". Mapping is stored encrypted and restored server-side.
🍯
Dual honeypot strategy — Attractive names ("email", "credit_card") lure bots, while pattern-matching names ("sk_ej84jy6g") catch bots that try to fill all similarly-named fields.
🔒
Hidden field extraction — CSRF tokens, session IDs, and backend metadata are extracted, encrypted, and stored server-side. Bots can't see or replicate them.
🔄
Per-session regeneration — In dynamic mode, every session gets a unique form layout. Knowledge from analyzing one session doesn't transfer to the next.
TRANSFORMATION EXAMPLE
ORIGINAL FORM
<form action="/submit">
  <input name="email"/>
  <input name="first_name"/>
  <input type="hidden" name="csrf"/>
</form>
↓ SpamKill transforms ↓
PROTECTED FORM
<form action="https://protect.spamkill...">
  <input name="sk_6Lin8xq5Zh"/>
  <input name="email" style="display:none"/> ← honeypot
  <input name="sk_MSMvop3jEH"/>
  <input name="credit_card" style="display:none"/> ← honeypot
  <script src="spamkill/sk.js"></script>
</form>
Choose your path

Three ways to install. All take minutes.

Pick whichever fits your setup. No backend changes required for any option.

🔌
WordPress Plugin
One-click install, automatic protection
⚡ 5 minutes
  • Install from WordPress plugin directory
  • Protects all forms automatically
  • Works with Gravity Forms, CF7, WPForms, Elementor, Divi, and more
  • Also protects WordPress comments and WooCommerce reviews
Install Plugin →
🔀
HTML Transformer
Paste your CRM's form code, get protected code back
⚡ 5 minutes
  • Web-based converter in your SpamKill dashboard
  • Paste your CRM's HTML form code in, get protected code out
  • Works with Keap, ActiveCampaign, HubSpot, Salesforce, ClickFunnels, Kajabi, and any platform with HTML forms
  • No backend changes needed
Try the Transformer →
📝
SpamKill Form Builder
Built-in forms for non-HTML platforms
⚡ 5 minutes
  • Build protected forms in SpamKill's dashboard
  • Connects directly to your CRM
  • For platforms that don't provide HTML form code
  • Currently supports GoHighLevel, with Kit/ConvertKit coming soon
Build a Form →
The quarantine system

You never permanently lose a lead.

Most spam tools make binary accept/reject decisions — if they're wrong, the lead is gone forever. SpamKill's quarantine system holds suspicious submissions for verification or manual review.

1

Submission flagged

Behavioral scoring identifies a suspicious submission. Instead of rejecting, it goes to quarantine.

2

User gets a verification challenge

The visitor can verify via WebAuthn biometrics, social login, or re-entering a field value. Not a CAPTCHA — it's identity verification tied to their specific submission.

3

Verified? Lead recovered.

If the user passes verification, the submission is released from quarantine and forwarded to your backend in the original format. If they don't attempt it, the submission stays in quarantine for your manual review.

Why this matters
reCAPTCHA / Cloudflare
Binary decision. If it's wrong, the lead is permanently lost. No way to review or recover.
SpamKill
Suspicious submissions go to quarantine. User can self-verify. You can manually review. Nothing is ever permanently lost.

For lead generation, every potential customer has value. Permanent rejection is unacceptable — quarantine with recovery is the only responsible approach.

Works with everything

Any form. Any platform. Any CRM.

WordPress plugin, HTML transformer, or built-in form builder. Three paths to protection. Zero backend changes.

WordPress
Gravity Forms
Contact Form 7
WPForms
Elementor
HubSpot
Salesforce
ActiveCampaign
Keap
ClickFunnels
Kajabi
GoHighLevel
See all integrations →
Ready to start?

Pick your path

Different businesses need different onboarding. Choose the one that fits.

Simple enough for a solopreneur.
Powerful enough for enterprise.

Five minutes to install. 99.9% accuracy. Zero impact on your visitors. That's the SpamKill promise.

Find Your Solution Our Story →