Catch AI-generated spam on your Shopify contact form without making real customers prove they’re human. Rule-based detection on every plan; Pro adds an AI second-opinion via Claude that catches templated and novel spam the rules can’t.
The problem · what arrives now
Your inbox is full of very polite nothing.
Spam filters were tuned for “Viagra” and “Nigerian prince.” That’s not what arrives anymore. What arrives is a one-paragraph enquiry about your actual product, in fluent English, signed with a fake name and a real-looking email.
Twenty of them a day. You read each one because the next might be a real customer. It never is. And you stop trusting your contact form.
The fix · how it works
An invisible field your customers never see and never type in. Anyone who fills it is a bot. Catches most of the volume before any other check runs.
Five submissions in a minute? Throttled. Email at a known disposable provider? Blocked. The cheap, fast checks happen next.
Off-topic pitches for SEO services, crypto launches, and “AI virtual assistants for your store” get flagged. The catalogue grows from real spam landing in real shops.
An AI second-opinion via Claude catches the templated and novel spam the rules can’t anticipate — with a verdict logged for every row.
Sea trial · the fence at work
Detection runs server-side after the form is submitted. Real messages land; the rest never reach you.
Pricing · read it in ten seconds
$0 / forever
The four rule-based layers, on every submission, from day one.
$9.99 / month
Everything in Free, plus the layer that catches what rules can’t.
The chart table · things merchants ask
It blocks a lot of the older mass-volume bot traffic. The shift since 2024 is that spam now arrives one carefully-written message at a time, from a residential IP, with a fluent body and a plausible-looking email. That doesn’t look like a bot to a risk-scoring engine, so it passes through. hCaptcha also gives you no log, no verdict reason, and no way to verify what was blocked. FormFence catches what gets past hCaptcha and shows you what it caught.
Four rule-based detection layers — honeypot, rate-limit, disposable email, and content patterns — run on every submission. The form block lives on your contact page. Up to 20 passed submissions are forwarded to your support email per month. You won’t see a dashboard, logs, or AI verdicts. Upgrade to Pro for the AI second-opinion, the dashboard, both logs with the AI verdict, the reply composer, CSV export, and unlimited email forwarding.
Detection is tuned to favour passing genuine enquiries. The honeypot only triggers when an invisible field gets filled in, which a real customer can’t do. Disposable-email and rate-limit checks use well-known providers and conservative thresholds. If a real enquiry ever slips into the blocked log, one click moves it back.
No. Detection runs server-side after the form is submitted, not inline on page load. Your storefront stays as fast as it was, and the theme extension adds a single small script.
FormFence stores hashed IP addresses, scrubs raw IPs after seven days, and implements Shopify’s three mandatory data-protection webhooks. Submission text lives in EU-hosted Postgres (Supabase, Stockholm). Full details in the privacy policy.
Drop anchor · Port 01
Stop replying to bots that don’t exist. Free plan with rule-based detection; $9.99/mo for the AI second-opinion, dashboard, logs, and reply composer.