Somebody fills out your contact form. A message shows up in your inbox. That's the whole mental model most business owners have, and for the sending half, it's basically right. What happens on our end before that message reaches you is more involved than people expect, and there's one part of it you'll never actually get to see.
The moment your form loads in someone's browser, Cantrip is already paying attention. A small script checks for a cookie tracking where that visitor came from: which campaign, which source, which page they landed on first. If it's not there yet, it reads that off the URL and saves it for thirty days, first touch only, so a visitor who clicks a Facebook ad today and comes back through a Google search next week still gets credited to the ad. Fill out the form during either visit and that attribution rides along as hidden fields, next to a stripped-down Google Analytics client ID, so you can trace a lead back to a session if you ever need to.
There's also a field on the form nobody sees. It's literally named "website_name," sitting off-screen, the kind of field a bot's autofill script grabs without thinking twice and a human never notices because they can't see it. Fill that one in and your form still says thanks, got it. It just quietly doesn't go anywhere. No error, no log, nothing.
A real submission gets checked again once it reaches our servers. Fill out the form in under three seconds and it's rejected, because no human reads a form and answers it that fast. Paste in three or more links, or anything that looks like a script tag, and it's rejected. Use an email address from one of a dozen known disposable-email domains and it's rejected. Every one of those rejections looks exactly like a success to whoever submitted it. That part's deliberate: tell a bot "nope, filtered," and it just adjusts and tries again.
Once a message actually clears all that, it lands in your Leads dashboard with the attribution data attached, and the notification email that hits your inbox sets its own reply-to automatically, pulled from whatever field in the form looks like an email address. Hit reply in Gmail and it goes straight back to your visitor. No copying an address out of the message body first.
Attachments get the same care. Someone uploading a resume or a reference photo is capped at 25MB a file, checked against a list of file types we won't accept, and checked against how much storage your account has left. Run out of room and the file gets dropped, but the message still comes through. The email just includes a note saying the attachment wasn't saved and why, instead of losing the whole submission over one file.
Here's the part worth knowing before you rely on any of this: there's no spam folder inside Cantrip. A rejected submission doesn't get flagged, logged anywhere you can see, or held for review. It just never becomes a row in your Leads dashboard. If a real customer pastes three reference links into their message, or their browser autofills the form fast enough to trip the timing check, or their company's email domain happens to overlap with the disposable list, they see the same "thanks, got it" a legitimate submission gets. You never know it existed. There's no undo button, because there's nothing left to undo.
That tradeoff is the honest one. A spam filter that told you exactly what it caught would also be telling bots exactly how to get past it. Ours stays quiet on purpose. Just know that quiet cuts both ways: it's also quiet about the messages that never should have been filtered in the first place.