A submission was marked spam

1. Inspect the stored record

Open the form’s Submissions → Spam folder and select the message. Review its submitted fields, Spam signals, and Policy used, not just the grade. A quarantined submission can return successful receipt while remaining outside Inbox. Rejected spam instead returns 422 and is not available as a stored message to restore.

2. Check the honeypot and timing

A completed honeypot is a spam signal. Keep the configured trap hidden, empty, and excluded from autofill; do not map a real visitor field to the configured trap name or _gotcha. If sending _cf_started_at, record form-start time as Unix seconds, not milliseconds or the instant the submit button is clicked. Very fast completion can increase the score.

3. Review enabled controls

On Pro and Business, check sensitivity, rejection mode, CAPTCHA, completion timing, blocked phrases, and email-domain rules in the form’s spam settings. Compare any rule matches with the legitimate message. Correct an overly broad rule one change at a time and retest from the real site. Keep baseline protection and avoid disabling all checks just to make one test pass. See Advanced spam controls for tuning guidance.

4. Restore a legitimate message

As the owner or a Triage member, select the message in Spam, choose Not spam, and apply. It moves to Inbox and counts toward accepted usage for its original receipt month. Viewers cannot apply this action. Restoring a message does not train a personal classifier or change form rules, and the bulk action does not itself send a notification.

5. Verify future submissions

After adjusting the responsible field or setting, send a new non-sensitive test and inspect its status and trust signals. If legitimate messages keep being quarantined, contact support through the site with the form, submission ID, receipt time, and relevant signal names. Remove personal field values from diagnostic examples.

• Advanced spam controls
• Notification email is missing