Form spam test: score a message 0–100
A form spam test scores the text of a contact-form message against classic spam signals: trigger phrases, ALL CAPS, repeated punctuation, link shorteners, suspicious domains and hidden Unicode. Paste a message below for a 0–100 score: 0–29 is clean, 30–70 is suspicious and 71–100 is spam. It checks message text only, not email deliverability.
Want to audit the form itself (honeypot, endpoint, CAPTCHA markup, labels) instead of a message? Use the contact form spam checker.
Last updated · Scoring runs locally; nothing is uploaded.
How to test if a message is spam: paste the message body into the box below and read the 0–100 score. Above 70 reads as spam, 30–70 as suspicious, and under 30 as clean to a rules-based filter.
- Paste the text: a contact-form message, comment, or inbound email body.
- Read the score and verdict, colour-coded clean / suspicious / spam.
- Check the rule hits to see which signals fired (caps ratio, spam phrases, link shorteners, Unicode tricks) and how many points each added.
- Note what it misses: a clean LLM-written pitch scores near zero. That's the gap behavioral checks (honeypot, time-trap, rate limits) are there to close on a real form.
No heuristic rules triggered. The text either looks clean — or it is modern LLM-generated spam that slips past simple rules.
What does this form spam test check?
It checks the text of one message against 15 fixed rules (spam phrases, ALL CAPS, repeated punctuation, link shorteners, suspicious domains, hidden Unicode and more) and adds up their points into a 0–100 score. It does not look at your form's HTML, your server or your email setup.
| What it scores | The text of one message: a form submission, comment or email body |
|---|---|
| Score | 0–100: the points of every rule that fires, capped at 100 |
| Bands | 0–29 clean, 30–70 suspicious, 71–100 spam |
| Rules | 15, each listed with its points and cap below |
| Privacy | Runs in your browser; the text is never uploaded |
| Not | An email deliverability, SPF/DKIM or inbox-placement test |
| Also not | splitforms' production spam filter (see below) |
Is this an email deliverability test?
No. This scores the text of a form submission; to test whether your emails land in spam, use an inbox-placement or mail-tester style tool.
Inbox-placement tools send a real email and check SPF, DKIM, DMARC and blocklists. If the problem is that your form's notification emails land in spam, read why contact form emails go to spam.
How is the spam score calculated?
Each rule below adds points when it fires, up to its cap, and the total is capped at 100. The scorer is deterministic: the same text always gets the same score.
This score is an illustrative heuristic, not splitforms' production filter. splitforms uses a honeypot, a time-trap and rule-based content scoring against a threshold, with different rules and weights from the ones listed here.
| Rule | Points | Cap | Why it matters |
|---|---|---|---|
| Spam phrasesAny of 37 stock phrases, e.g. "act now", "risk-free", "claim your prize" | 8 per phrase | 40 | Scam and hard-sell copy reuses the same phrases. One alone is weak; several together are a strong signal. |
| Excessive ALL CAPSOver 60% of letters uppercase (20+ letters) | 0.8 per % over 60% | 20 | Shouting is a bulk-spam style. Normal messages are mostly lowercase. |
| Repeated punctuationRuns of 3+ ! ? or $, e.g. "!!!" | 5 per run | 15 | Manufactured urgency. People rarely type three exclamation marks in a business enquiry. |
| High URL density3 or more http(s) links | 5 per link beyond 2 | 15 | Link spam exists to place links. A real enquiry rarely needs more than one or two. |
| Link shortenerA link on bit.ly, tinyurl.com, goo.gl and 10 more | 12 flat | 12 | Shorteners hide the real destination, which is why spammers use them. |
| Bare IP-address URLA link to a raw IPv4 address, e.g. http://203.0.113.7/ | 14 flat | 14 | Legitimate sites use domain names. Raw-IP links usually point at throwaway or compromised servers. |
| Suspicious TLDA link on .xyz, .top, .click and 11 more | 10 flat | 10 | Cheap top-level domains are popular for disposable spam landing pages. |
| Repeated character runsThe same letter 5+ times in a row, e.g. "aaaaa" | 8 flat | 8 | Keyboard mashing and filler text from scripted bots. |
| Repeated FREE shoutingCapitalized "FREE" 2+ times | 4 per FREE | 10 | A classic marketing-spam tell that word lists alone can miss. |
| Zero-width unicodeInvisible characters U+200B–U+200D or U+FEFF | 12 flat | 12 | Hidden characters split words so a filter's word list no longer matches them. |
| Mixed Latin + CyrillicLatin and Cyrillic letters in the same text | 10 flat | 10 | Look-alike Cyrillic letters (homoglyphs) disguise words. It also fires on genuine bilingual text. |
| Suspiciously shortUnder 8 characters | 5 flat | 5 | Empty or one-word fills are typical of bots testing a form. |
| Suspiciously longOver 4,000 characters | 6 flat | 6 | Pasted bulk content and keyword stuffing. |
| Multiple email addresses3+ email addresses in the text | 8 flat | 8 | Spam often lists several contact addresses. A real sender gives one. |
| Multiple dollar amounts2+ amounts like "$99" | 6 flat | 6 | Price-heavy pitches are typical of sales and scam spam. |
Score bands: 0–29 clean, 30–70 suspicious, 71–100 spam.
What splitforms' production filter checks
On a live form, a submission first meets the honeypot, the time-trap and per-IP rate limits. Content scoring then records a reason for each signal it finds. These are its reason names; the weights and threshold are not published here, so this page doesn't double as a guide to slipping past them.
- Links to many different domains
too_many_links - The same link repeated
repeated_link - Known spam vocabulary
spam_words - Disposable email address
disposable_email - Repeated text
repeated_text - Message that is only a link
url_only_message - Gibberish message
gibberish - HTML link markup
html_link - BBCode link markup
bbcode_link - Throwaway top-level domain
suspicious_tld - Suspicious hostname
suspicious_host - Malformed email address
malformed_email - Cyrillic text (corroborating only)
cyrillic_text - Random-looking name
name_looks_random - Link in the name field
url_in_name - One-token throwaway message
short_gibberish - Injection or attack probe
attack_probe
How do I stop contact form spam without a CAPTCHA?
Add a hidden honeypot field that bots fill in and people never see, plus a time-trap that rejects forms submitted within 2 seconds of loading, then score the message content on the server and rate-limit repeat posts from one IP. Generate the honeypot markup with the free honeypot generator, and follow the contact form without CAPTCHA guide for the full setup.
Why does heuristic spam detection miss modern spam?
Because its rules were written for human-written spam. A heuristic filter is a list of rules: word lists, ratio checks, regex matchers, length thresholds. The scorer on this page is a representative one. For old-school spam (ALL CAPS shouting, “FREE iPhone,” bit.ly links, repeated exclamation marks, Cyrillic homoglyphs) those rules work well: the score climbs fast and the verdict is unambiguous.
Some form spam is now written by language models: grammatically clean English, no shouting, no shorteners, no obvious phrase triggers. A scraper prompts for “a polite outreach pitch about web design services” and posts the output through every contact form on a list. None of the rules in this tester fire on that text, because they key on patterns (misspellings, shouting, broken grammar) that LLM output doesn't have.
That is why a real form needs more than one layer. splitforms pairs rule-based content scoring (links, spam phrases, disposable emails, gibberish and suspicious domains) with a honeypot, a time-trap and rate limits. None of that reads prose the way a person would, so a fluent pitch can still get through on wording alone, but the domain, email and behavioral signals catch a lot of what a single text scorer can't.
How does splitforms catch what this tool misses?
With three layers of spam handling, in order of cost. You want all three on: they cover different kinds of spam.
- Tier 1 · Free
Honeypot field
Hidden input that real users never see and never fill. Bots that auto-fill every field fill it, and the backend drops any submission where it has a value. Catches the laziest scripted spam at zero cost. On by default for every splitforms form.
- Tier 2 · This tool
Heuristic rules
Word lists, caps ratio, suspicious URLs, repeated characters, Unicode tricks, length extremes. Catches old-school marketing spam and obvious bot output. The scorer above implements this class of rules: useful, but blind to LLM-written spam.
- Tier 3 · splitforms
Server-side spam scoring
More checks than a client-side demo can run: spam vocabulary, disposable-email and suspicious-domain detection, gibberish and repeated-text checks, plus a time-trap and per-IP rate limits. Quarantined submissions go to a Spam tab, not your inbox.
Qualitative · not measured frequencies
What does contact-form spam look like?
Four recurring patterns, described qualitatively. They are not ranked or counted, and each example is paraphrased rather than a real submitted text, but the structure matches what bots and outreach scrapers post.
The fake collaboration pitch
“Hello, I came across your website and I’m impressed with your work. Our team helps businesses like yours scale through targeted outreach — would love to schedule a brief call to share what we do.”
How splitforms handles it: Plausible English with no word-list hits, so the tester above scores it near zero. On a real form the wording alone may pass too; the honeypot, the time-trap and the disposable-email and suspicious-domain checks are what can still catch the bot behind it.
The SEO backlink scheme
“We help websites rank on Google. We can offer high-quality DA60+ backlinks for $99/month. Reply if interested.”
How splitforms handles it: SEO vocabulary counts only weakly in splitforms' content scoring, because agencies and studios get genuine enquiries that use the same words. It needs a corroborating signal, such as repeated links, a disposable address or a suspicious host, before the message is quarantined.
The scripted form fill
A real-looking name, an address like [email protected] and a one-word message, posted over and over from rotating IPs.
How splitforms handles it: The text is clean, so content scoring has nothing to flag, and per-IP rate limits only slow down repeats from one address. The honeypot catches scripts that fill every field and the time-trap catches ones that submit within seconds of loading the form; for the rest, splitforms also verifies Turnstile or reCAPTCHA v2 if you add one.
The honeypot-aware bot
A bot that reads the form HTML, spots the hidden honeypot field and skips it on submit. The body is a standard “Free SEO audit?” pitch with a link.
How splitforms handles it: Skipping the honeypot defeats that one layer only. The time-trap still applies if the form uses one, and content scoring still checks the links, the hosts and the sender's address.
Form spam test FAQ
Is this spam test really free?
Yes. No signup, no rate limit, no watermark. The scorer is plain JavaScript shipped with this page, and there is no paid tier of the tester itself. We built it to show the kind of rules a basic spam filter applies, and what a real form needs on top of them.
Does this tool send my data anywhere?
No. The scorer runs entirely in your browser. Nothing is uploaded, logged, or sent to any server. You can disconnect from the internet after the page loads and it keeps working.
How accurate is this spam score?
It is a directional check, not a verdict. The scorer applies the 15 rules in the table on this page, and the same text always gets the same score. It reliably flags old-school marketing spam, and it misses polished LLM-written spam, which is grammatically clean and avoids every word-list trigger.
What is a good spam score?
On this tool, lower is better: 0–29 clean, 30–70 suspicious, 71–100 spam. Other tools use different scales (mail-tester scores out of 10, SpamAssassin uses points), so scores aren't comparable across tools.
What are the most common spam trigger words?
Money and urgency phrases ('guaranteed', 'act now', 'risk-free'), prize and scam phrases ('congratulations', 'claim your prize'), and crypto or adult terms. Context matters: one trigger word rarely makes a message spam, but several together do.
Is this score how splitforms filters spam?
No. This page runs an illustrative heuristic with its own rules and points. On a real form, splitforms checks a honeypot field and a time-trap, rate-limits repeat posts per IP, and runs rule-based content scoring against a threshold, with different rules and weights. Quarantined submissions go to a Spam tab you can review. It's on every plan, including the free tier.
Why does my contact form get so much spam?
Bots crawl the web for form tags and post SEO, outreach and crypto pitches automatically, and AI-written pitches avoid simple word lists. A honeypot, a time-trap, rate limits and content scoring together blocks most automated spam.
Can I use this to test my contact form before deploying?
You can test sample messages with it: paste one, see which rules fire, and adjust any auto-reply or template copy that looks spammy. To audit the form itself (honeypot, endpoint, CAPTCHA markup, labels), use the contact form spam checker. Once you're live, the splitforms Spam tab shows what was actually quarantined.
What's the difference between a honeypot and content-based spam scoring?
A honeypot is a hidden form field that real users never see and never fill in. Bots that auto-fill every input fill it, and the server drops any submission where it has a value. Content scoring checks the submitted text itself (spam phrases, disposable emails, suspicious domains, gibberish), which catches bots smart enough to skip the honeypot. They are layers, not alternatives.
Does splitforms work with reCAPTCHA?
Yes. splitforms verifies Cloudflare Turnstile and Google reCAPTCHA v2 tokens server-side once you save the secret key in the form's settings. Most forms don't need one: the honeypot, time-trap and content scoring run without adding a challenge for visitors.
How do I report false positives?
Open the Spam tab in the splitforms dashboard and mark the submission as not spam. Marking a submission "Not spam" allowlists that sender's email so the content filter stops quarantining them; marking it as spam removes the allowlist entry. Spam filtering and the allowlist are included on the free plan.
Related: contact form spam checker · stop contact form spam · reCAPTCHA alternatives
Want spam filtering on your real contact form?
Rule-based spam filtering runs on every splitforms submission (honeypot, time-trap, content and link rules). Free for 500 submissions. No CAPTCHA required. When you need more, Pro is $5/mo and Annual is $49/year; see pricing.
Get a free splitforms key →