Spam heuristics

Spam heuristics are content-based rules that judge a submission by what it says rather than how it arrived. Where honeypots and rate limits examine behavior - which fields were filled, how fast, how often - heuristics read the payload itself and look for the textures spam reliably has: messages stuffed with links, sender addresses from disposable email domains, payloads that are empty or gibberish, text in patterns humans do not produce.

Each rule is a probability, not a proof. A message with five links is usually spam, but a legitimate customer occasionally pastes several URLs into a support form. That is the defining trade-off of heuristic filtering: every threshold is a dial between catching more spam and wrongly flagging more real submissions, and there is no setting that eliminates both errors at once.

Two design choices make heuristics livable. First, expose the dial - different forms have different tolerance, and a lead-generation form should be tuned more cautiously than a comment box. Second, make the failure mode cheap: a heuristic that routes its suspects to a review queue can afford to be aggressive, because a false positive costs a few seconds of human attention instead of a lost lead.

SheetLink Forms makes both choices. Its content heuristics check for link stuffing, disposable email domains, and empty payloads, governed by a per-form strictness dial with loose, normal, and strict settings. Anything the heuristics flag is quarantined for one-click review - approving delivers the row as if nothing happened - and is never silently dropped. Only the honeypot, which no human touches, marks spam outright.

The full stack the heuristics sit in is described on the security page, and you can post to a defended form on the live demo.