Security architecture
Five layers between every spam bot and your inbox.
Any single anti-spam trick fails against a determined spammer. Layered together, they force an attacker to defeat every layer at once — which, in practice, means they move on to easier targets. Here’s exactly what happens to every submission your customers send, in order.
Layer 01
Honeypot field
Filters 80% of automated form spam before any code runs.
Every SecureSMTP form embeds a hidden field a real user never sees but bots almost always fill. If that field contains anything, the submission is silently accepted (so the bot moves on and doesn’t retry) but never delivered. Zero friction for humans, invisible cost for us.
What it stops
Basic form-filling bots, first-generation LLM crawlers, most spam scripts.
Layer 02
Per-IP rate limiting
Caps abuse without inconveniencing real visitors.
A single IP can submit at most 5 forms per minute per site. Break the limit and we return HTTP 429 — no email fires, no database row created. Rate limit state is in-memory per pm2 process so it survives DDoS-scale traffic without back-pressure on the DB.
What it stops
Determined manual spammers, credential-stuffing bots that iterate through your form, coordinated DDoS-style form abuse.
Layer 03
HMAC-signed submissions
Cryptographic proof the form came from your site.
For Shopify and app-proxy submissions, every request is signed by Shopify with your app secret. We verify the HMAC-SHA256 signature in constant time before touching the database. A submission with an invalid or missing signature returns 401 — no email, no log, no exposure.
What it stops
Direct API abuse, replayed submissions, spoofed sources trying to bypass the storefront.
Layer 04
DKIM + SPF-aligned sending
Every notification is cryptographically signed as yours.
Notification emails are sent from SecureSMTP’s own mail servers with SPF + DKIM aligned to your verified sending domain. Gmail, Outlook, and Yahoo verify both records before delivery. Recipients never see "via securessmtp.com" in their inbox — the email looks like it came straight from your brand, because it did.
What it stops
Spoofed From-addresses trying to impersonate you, DMARC quarantine on Gmail bulk-sender rules, spam-folder classification for unauthenticated mail.
Layer 05
AI spam classification
A second-opinion layer for the messages that survive the first four.
Every submission is scored by our spam classifier — a lightweight model trained on real form submissions and known-bad templates. High-score messages are flagged in the delivery log and (optionally) held for review instead of being emailed. Low-score messages flow through immediately.
What it stops
LLM-written spam, human spammers targeting your specific niche, subtle abuse patterns the first four layers can’t catch.
What this means in practice
For a small site running Contact Form 7 or WPForms without SecureSMTP, a typical week looks like: ~40 real submissions, ~120 automated spam entries, ~10 that slip the plugin’s filter and reach the inbox. The signal-to-noise ratio erodes over time and site owners eventually stop reading the notifications.
For the same site behind SecureSMTP, the same week: ~40 real submissions, 0 spam that reaches the inbox. Every spam attempt either dies at the honeypot, gets rate-limited, or lands in the flagged bucket in your dashboard. The notification emails you receive are all real.
The layers are ordered by cost: the cheapest checks run first, the AI classifier runs last. A submission that hits the honeypot never touches the model. This keeps the free tier viable even at high spam volumes.
Try it on your form.
Free plan covers 100 protected submissions per month. Setup is a plugin install and a DNS record.