heurilens

Hi,

I had this exact problem on a client’s CF7 form — reCAPTCHA v3 and Honeypot both “on”, spam still landing in Flamingo as “Not spam / mail_sent”. Two things I learned the hard way:

reCAPTCHA v3 doesn’t block anything by itself, it just scores (0–1) and CF7 only rejects below 0.5. The spam hitting us now comes from real headless browsers on rotating IPs, so it scores high (0.7–0.9) and sails right through — and Honeypot only catches bots dumb enough to fill hidden fields. If you add a snippet to log the v3 score into Flamingo, you’ll probably see the same thing, which means raising the threshold just starts blocking real people before it stops the spam.

What actually fixed it for me was routing the CF7 notification email through https://humainbox.com you literally just swap the recipient email in the form’s Mail tab for the address it gives you, no plugin. It reads the message content and holds the AI-generated junk instead of the “is this a bot” guessing game. It fails open (if anything breaks, the message still gets delivered, so you never lose a real enquiry), and it has a dry-run week where everything still comes through but it shows you what it would have held — so you can check it against your real traffic before trusting it. Free tier covers a single form.

Been running it for a while now and the inbox is finally quiet. Worth a look before you start tweaking thresholds.