The Lead You Never Saw Was in the Spam Tab
"I filled out your form twice"
Illustrative scenario, not a client story; results vary.
Picture a small guitar repair shop. For a few weeks, the contact form on its website has been filling up with junk: strange offers, links to nowhere, messages that read like a robot wrote them, because one did. The owner is tired of wading through it every morning, so they open the form's spam settings and turn the protection all the way up.
It works. The junk stops showing up. For two weeks the inbox is quiet and clean.
Then the phone rings. A customer, a little annoyed, says: "I filled out your form twice. Nobody got back to me." They wanted a quote on a cracked headstock. They tried the website first, because that's what the website is for. Both of their messages were sitting in the form's Spam tab, right next to the junk.
The owner did the reasonable thing. Junk was piling up, so they turned the protection all the way up. Nobody told them the filter could be wrong in the other direction too.
That's the belief this post takes apart: "Spam on my contact form is just an annoyance. The filter handles it, and if someone real reaches out, I'll get the email." The filter does handle a lot. But it doesn't handle it perfectly, and when it's wrong about a real person, you usually never hear about it. This customer called. A customer who gets no reply might not call at all; they might just try the next shop.
Here's the idea underneath it: every spam filter makes two kinds of mistakes. It lets some bots in, and it locks some customers out. You only ever notice the first kind, because junk is loud. The second kind is silent.
Why bots fill out forms at all
Before anything else, it's worth saying: spam protection matters. Turning it off isn't the answer.
Bots fill out contact forms because forms are an open door. Anyone, or anything, can type into them. Wix explains the problem plainly: "Spambots are designed to sound like human users in the way they write, but they are not usually able to sustain an interaction with a real human." In other words, a bot can write one convincing message. It just can't hold a conversation. That's why so much form spam looks almost real at first glance and falls apart the moment you read it closely.
The cost isn't only annoyance. On sign-up forms, Wix notes that fake sign-ups lead to "your members' list being filled with fake email addresses and makes it harder for you to identify real members." The same thing happens with contact forms and your customer list. Every fake entry is one more thing to wade through before you find the real person, and one more fake contact cluttering the place where you track leads.
So the goal isn't "no spam protection." It's a good setting: strong enough to keep most bots out, not so aggressive that it starts catching your customers. That middle ground is a choice, and many owners don't realize they're making it.
The dial: three levels, not an on/off switch
On Wix's new Forms, spam protection isn't a single switch. It's a dial with three settings. As of this writing, Wix describes them this way on its help page about protecting your site forms from spam:
"Only reCAPTCHA: This is the lowest level of spam protection. It uses invisible reCAPTCHA to analyze site visitor behavior and determine if they are human or a bot. If suspected to be a bot, a challenge is shown."
"Basic and reCAPTCHA: This is the mid-level spam protection. After passing invisible reCAPTCHA, submissions go through a basic spam filter that labels spam based on criteria like network identifiers and contact information."
"Advanced and reCAPTCHA: Includes reCAPTCHA and the basic filter, plus an advanced filter using additional technologies to mark spam."
Wix adds that "This highest level of spam protection is only applied if the other two filters do not mark the submission as spam." Each level stacks on the one below it. More layers means more chances to catch a bot, and more chances to catch a person by mistake.
Wix also notes that "If we detect unusual activity on your site, a reCAPTCHA field may still appear on a form, even if you haven't enabled the feature." So some protection runs in the background whatever you pick.
Why can a filter be wrong at all? Look at how Google describes one version of reCAPTCHA. Its developer page for reCAPTCHA v3 (last updated 2024) says: "reCAPTCHA v3 returns a score (1.0 is very likely a good interaction, 0.0 is very likely a bot)." Wix doesn't say which version it uses, only "invisible reCAPTCHA," so don't read this as a description of Wix. But the language is the lesson: "very likely." Bot detection is a judgment about likelihood, not a certainty. And any judgment about likelihood will sometimes be wrong about a real person.
That's why every level is a trade-off. Choose it on purpose instead of cranking it to the top after one bad week.
Where real leads hide: the Spam tab
When Wix's filter decides a submission is spam, it doesn't throw it away right away. It sets it aside. Here's the line on that same help page that matters most for this post: "The spam submission will stay in the Spam tab for 30 days, then be permanently deleted. You can unmark submissions marked as spam at any time."
Read that twice. The Spam tab is a second lead inbox, and it has an expiry date. Anything real that lands there can be rescued with one click, but only while it's still there. After that, it's gone for good, and nobody tells you it was ever there. (This is how Wix describes its new Forms. If your site still uses the older form builder, check Wix's help pages for your version rather than assuming it works the same way.)
Illustrative scenario, not a client story; results vary.
Picture a home inspector who gets a lot of business from local realtors. One realtor sends a referral through the inspector's website form: a buyer who needs an inspection before a closing date. The realtor sends it from a shared office address that a dozen agents use. The filter flags it. The inspector never sees it. The realtor assumes the inspector was too busy and sends the next buyer to someone else.
Nobody did anything wrong. The realtor used the form. The filter did its job as designed. The inspector just never looked in the one place the referral was waiting.
The fix isn't complicated. Open the Spam tab regularly, skim it, and unmark anything that's a real person. The hard part is remembering it exists.
The other spam folder: your own inbox
Here's the part that's easy to miss: there are two spam folders between a customer and you. The first is the form's Spam tab on your site. The second is the junk folder in your own email.
Even when your site accepts a submission as real, it still has to email you about it. That alert can get filtered on your end. Wix's form troubleshooting page tells owners who aren't getting form notifications to check their Spam or Junk folder "for emails from [email protected] or [email protected]". It also warns: "If the sender and recipient email are the same, change the recipient email. Some email providers treat these messages as spam."
And there's one more trap, which Wix answers directly: "No. Changing your Wix account email address does not update the recipient in your form automations."
Illustrative scenario, not a client story; results vary.
Picture a wedding officiant who started out with a personal Gmail address and later moved to a professional address on their own domain. They updated their Wix account email, their business cards and their email signature. Everything looked current. But the form alerts kept going to the old Gmail inbox, which they barely open anymore. Couples were filling out the inquiry form for dates months away, and the alerts were piling up in an inbox nobody checked.
The site did its job. The submissions were real and they were accepted. They just landed somewhere no person was reading. That's the quiet version of the same mistake: not a bot problem at all, but a "who gets the alert" problem.
A weekly Form Inbox Check
This takes about ten minutes a week, and you don't need to touch any code.
Pick a spam protection level on purpose. Start in the middle and adjust based on what you see, rather than jumping to the top after one bad week.
Open your form's Spam tab once a week, long before anything is deleted, and unmark anything real.
After any change to your form or your email, send yourself a test submission and watch where it lands.
Confirm your form alerts go to an inbox a person actually reads, and that the sender and recipient addresses aren't the same.
Check your own Junk folder for messages from Wix's form sending addresses.
Keep junk out of your CRM so real contacts are easy to find.
Once a submission does reach you, what happens next matters just as much. We covered that in our post on the contact path from form to follow-up.
This is usually where a self-check stalls: step 2. Lots of owners have never seen their Spam tab, and it's hard to know what "real" looks like in a pile of junk.
Never opened your Spam tab, or not sure who gets your form alerts? That's normal. Lots of forms get set up once and never tested again. In a free 30-minute Form Inbox Check, we'll open your Spam tab with you and see whether a real customer is sitting in it before the 30 days run out. Bring your website URL and be logged in to your site. We'll also check your spam setting and where your alerts go, then send a test inquiry together and watch it land.
What this isn't
This isn't a security audit, and no setting gets you zero spam or zero missed inquiries. Every filter makes judgment calls, and help pages change, so check Wix's current wording for your own site. Results vary.
What it is: a habit. A protection level you chose on purpose, a Spam tab you actually look at, and alerts that reach a person.
If checking the Spam tab, testing the form and keeping your CRM clean is more than you want on your plate, that's the kind of website and lead handling work Marketing Munster does on Wix and Syndra sites.
A note on the examples: The guitar repair shop, home inspector and wedding officiant in this post are illustrative composites, not clients, and results vary. Wix wording is quoted from the Wix Help Center (Protecting Your Site Forms from Spam, Understanding Bots and Spammers and Wix Forms: Troubleshooting), and Google wording from Google for Developers (reCAPTCHA v3), as of the fetch date, and may change; nothing here suggests either company endorses this advice.
Your spam filter is doing two jobs, and you only ever see one of them. Bring your website URL to a free 30-minute Form Inbox Check and be logged in to your site. You'll leave knowing whether anything real is sitting in your Spam tab right now, where your form alerts actually go, which protection level fits your site, and with a test inquiry that landed where it should. Fix it yourself, or have Marketing Munster set it up and keep an eye on it.