Form spam filter
A small system that scores contact form submissions using cheap structural signals first and a model only for the genuinely ambiguous ones, sends the obvious enquiries straight through, and holds the rest where somebody can see them. It never deletes anything. Seven posts on the same system — one diagram at a time — with a cost breakdown and an engineering reference at the end.
- 01
A form spam filter on AWS for a few dollars a month
The whole system on one page — cheap signals, a narrow model band and three destinations — with the cost asymmetry that shapes every threshold.
- 02
How the cheap signals work
Six structural signals that cost nothing to collect, what each is actually worth, and the two that are commonly implemented in a way that catches real people.
- 03
How the model band stays narrow
What the model is actually asked, why only about one submission in ten reaches it, the question it is deliberately not asked, and what it does with the answer.
- 04
How a borderline reaches a person
The review queue that has to take ninety seconds a day, why it is a queue rather than a folder, and the quarantine search that resolves the conversation every business eventually has.
- 05
How the filter stays tuned
Why only one of the two error rates is measurable, what the review queue’s size tells you, and the monthly numbers that say whether the thresholds need moving.
- 06
What the form spam filter costs
About $2 a month. One Bedrock read per submission is the only line that grows; the queue, the table, the mail and the storage are rounding errors. Plus the three ways the bill could surprise you.
- 07
Engineering reference: the form spam filter architecture
Same system, drawn purely for engineers. Service names, region, Lambda inventory, IAM scopes, the schemas and the exact model id.
Frequently asked questions
- What is a form spam filter?
- A small serverless system that scores contact form submissions, delivers the obvious enquiries immediately, holds the ambiguous ones in a review queue, and never deletes anything. It is asymmetric on purpose: a missed lead costs far more than a spam message.
- Why not a CAPTCHA?
- Because a CAPTCHA taxes every genuine visitor to stop a problem caused by a small number of bots, and the measurable drop in form completions is usually larger than the spam volume. The structural signals in this design catch most bots and cost a visitor nothing.
- Does it delete spam?
- No. Everything is retained, in one of three places. Obvious spam goes to a quarantine nobody reads day to day but which can be searched when somebody says they submitted a form and heard nothing.
- How much does it use a model?
- Only for the middle band. The cheap signals classify the large majority for free, and the model sees perhaps one submission in ten — which keeps it affordable and keeps the decisions mostly deterministic.
- What does it cost to run?
- A couple of dollars a month for a few hundred submissions. See part six.