Why spam gets past your CAPTCHA

Spam typed by people is written to pass as a real enquiry. A few kinds make up most of it:

• Marketing pitches: an SEO audit of your site, a redesign, more reviews, a ranking on the first page.
• Lead generation: a list of prospects for sale, an appointment setter, a partnership that needs a call first.
• Link and content offers: a guest post, a link exchange, an article they would like to place on your site.
• Scams: an invoice you do not owe, a domain about to expire, an investment that cannot lose.

The same message arrives again and again with the name, the company and the greeting swapped. Each copy reads plausibly on its own, which is exactly why someone has to read it to throw it away.

Every CAPTCHA, visible or invisible, answers one question: is a person sending this? An image puzzle asks the person to prove it. A risk score guesses it from how the browser behaves. A proof-of-work check like Challenge makes every submission cost CPU time, which only matters at volume.

For a pitch a person wrote, the answer to that question is yes. A real person opened the page in a real browser, typed into the form and pressed Send. They pass every test for humans because they are one. Making the test harder only makes it harder for your customers too.

The same holds for most other bot defences. A honeypot field stays empty, because a person never sees it. A rate limit is never reached, because one person sends a few messages a day. A blocklist of addresses rarely helps, because nothing about one person's connection marks it out.

The one thing that separates a pitch from an enquiry is what it says. So the layer that stops it has to read the content, the way you do when you skim the inbox.

Keyword rules are the first thing most people try. They break both ways: senders change the wording within days, and the rules start flagging real customers who mention the same words. A model trained on real form traffic does better, because it judges the whole message rather than a list of words.

Classify is that layer as an API. Your server sends the submission after the form reaches it, and Classify answers with a label, spam or clean, a score from 0 to 1, and the model that answered. Its model is Botpoison's own, trained on two years of real form submissions, and it reads more than English.

Send the whole form when you have it. The name, the email address and the other fields help the verdict as much as the message does. See the Classify getting started guide, or the test mode page for a request you can run with the test key.

A classifier is a judgement, and it will sometimes be wrong. What matters is how often it flags a good message, because that is the mistake that costs you a customer. The spam label starts at a score of 0.8, and Classify flags about 1 in 1,000 good messages at 0.8, counted across all the traffic in our reference set. Your own traffic will differ.

So the score is there to let you choose. Deliver what is clearly clean, file away what is labelled spam, and hold the messages in between in a review queue that a person reads. You decide where that queue starts.

Reading someone's message is a privacy question. The model that reads it is Botpoison's own and runs in the EU (Ireland). No outside AI vendor sees the message.

A classifier does not replace a bot defence. Bots still send the bulk, and there is no reason to pay to classify messages a bot defence would have refused for free. The two layers split the work: one stops the bots before the form is sent, the other reads what a person typed.

If your current CAPTCHA asks visitors to solve puzzles, Challenge can take its place without asking anyone anything. Both products are on one plan, each with a free allowance; see pricing.