自分がプロダクトをつくるときに考えていることとそのプロセスをリバースエンジニアリングし、Product Making Framework(PMF)と題して、枠組みを CC BY として公開してみる試みです!解説記事も書きました。
Making of Emopi #0 - 世界観からプロダクトをつくる https://t.co/X68qZgvXC6
TIL: AI bots now solve reCAPTCHA challenges with ~50% success rate.
That means 1 in 2 "I'm not a robot" tests no longer stops bots.
The new signal that actually works? Behavioral timing.
Bots fill forms in <300ms. Humans take 4–8s.
No puzzle. No friction. Just math.
We ran formpuppy across 100k form submissions this quarter.
Numbers:
• 61% flagged as spam
• Bot avg fill time: 190ms
• Human avg fill time: ~6s
• False positive rate: <1.5%
Behavioral timing is the single most reliable signal we've found. Silent. Frictionless. Accurate.
What % of your contact form submissions are actually spam?
New data: 50% of reCAPTCHA challenges are now solved by bots.
On high-traffic sites, spam rates hit 60–80% — burying real leads underneath.
What does your spam ratio look like?
IP blocklists flag known bad actors.
But AI spambots rotate IPs constantly — a new address every attack.
Behavioral timing catches them anyway: humans take 4–8s to fill a form, bots do it in <300ms.
IP reputation = reactive. Timing analysis = proactive.
TIL: Spambots now use "Bayesian poisoning" — mixing legit words into spam to fool keyword-based filters.
Your block-list is useless against it.
Behavioral timing + pattern analysis catches what keywords miss. That’s the shift in 2026 form spam defense.
I once spent 2 hours trying to figure out why no one was contacting me through my site.
Turns out: 40% of my form submissions were spam. Real leads were buried.
That's why I built formpuppy — behavioral spam filtering, no CAPTCHA, no friction.
45% of form spam in 2026 hits sign-up forms. 35% hits contact forms.
Most of it now uses AI patterns that bypass CAPTCHA entirely.
What is your current spam setup -- and has it held up this year?
Here's how formpuppy's spam layers actually break down:
→ Behavioral timing catches ~60% of bots
→ Honeypot fields catch another ~20%
→ IP reputation scoring gets ~15% more
~95% of spam blocked before a CAPTCHA ever appears.
That's the stack we ship by default.
CAPTCHA reduces contact form conversion by up to 10%.
Invisible spam filters — behavioral timing, IP scoring, honeypot — block the same bots with zero friction.
If your form still shows a CAPTCHA puzzle in 2026, you're losing real leads to fight spam.
TIL: The average bot submits a contact form in under 300ms. Humans take at least 4–8 seconds.
That timing gap alone catches ~60% of automated spam — no CAPTCHA, no annoying puzzles.
formpuppy uses behavioral timing as one of its first-line filters.
If you run a WordPress or Webflow site — how are you protecting your contact forms from spam right now?
CAPTCHA? Honeypot? An anti-spam plugin?
In 2026, AI bots beat each of those alone. Layering them is the only approach that consistently holds.