Forms walkthrough

How submissions flow

Every submission travels through three stages — the WordPress site, the SecureSMTP platform, and the inbox. Understanding this flow makes troubleshooting much easier.

1. 1

   WordPress

   The visitor fills in the form on your site and clicks submit. The SecureSMTP WordPress plugin runs its first-line spam checks (honeypot, time-trap, nonce) and a per-IP rate limit. If those pass, the plugin POSTs the payload to api.securessmtp.com over HTTPS, signed with your site’s API key.

2. 2

   SecureSMTP platform

   Our API validates the signed token, runs Cloudflare Turnstile verification (invisible), records the submission in your account, and (depending on your plan) hands the message to the AI classifier for a final score. The submission appears in your dashboard within ~1 second.

3. 3

   Inbox

   If the submission scores below the spam threshold, SecureSMTP hands it to Resend for delivery — sender [email protected] with Reply-To set to the visitor’s email, so hitting Reply in your inbox emails the visitor directly. Spam-flagged submissions are still recorded but not emailed; you can review them at /app/forms/flags.

Build a form: WP plugin vs platform builder

SecureSMTP supports two flavours of form. They share the same backend; pick whichever workflow fits how you build pages.

Need the in-WP step-by-step with screenshots? See the full setup guide.

Inspect submissions

Submissions are visible in two places. Either is the source of truth — they update each other within ~1 second.

Filters and CSV export

The platform submissions view supports filters across:

• Date range

  Last 24h · Last 7d · Last 30d · Custom

• Site

  One specific WordPress install or all

• Form

  A specific form within a site

• Classification

  Genuine · Spam · Suspicious · Newsletter

• Delivery status

  Delivered · Soft bounce · Hard bounce · Blocked · Held

• Free text

  Searches across name, email, message

Click Export CSV in the top right to download whatever the current filter is showing. The CSV preserves field order and includes the classification score and the delivery status — handy for handing leads to a CRM or running pivot analysis in a spreadsheet.

Spam protection — 5 layers, all on by default

SecureSMTP layers defences so genuine submissions pass through silently and spam never reaches your inbox. You don’t configure any of this — it’s all on the moment you install the plugin.

1. 1

   Honeypot + time-trap + nonce

   A hidden field bots fill in but humans don’t see, a minimum-time-on-page check, and a single-use form token. Catches ~95% of dumb spam before it leaves your WordPress server.

2. 2

   Per-IP rate limit

   1 submission per minute per IP per form. Crosses the line and the IP gets a 5-minute cool-down. Repeat offenders get a longer block — see /help/blocks.

3. 3

   Signed API token

   Each plugin request is signed with your site’s API key. We reject anything else at the edge — no signed token, no submission.

4. 4

   Cloudflare Turnstile

   Invisible CAPTCHA that scores the visitor’s session. Real humans never see a challenge; bots get an invisible reject.

5. 5

   AI classifier (Claude Haiku)

   For borderline submissions we ask Claude to classify the intent. Catches well-crafted spam that the keyword filter misses — long-form scams, fake quote requests, language-model output. Free plan uses heuristic only; paid plans get a quota of AI calls.

Email notifications

Every genuine submission triggers an email to the addresses you’ve set as recipients.

• Default recipient is the address on your SecureSMTP account. Change it per-form in the form editor → Notifications tab.
• Multiple recipients supported — comma-separate them. Send a copy to me is a one-click checkbox.
• Sender is always [email protected] by default. If you want your own domain in the From: header — for branding or deliverability — set up DKIM for a custom domain. See /help/email-delivery.
• The visitor’s email is set as Reply-To — hit Reply in your inbox to reply directly to them.