From a spam-prone contact form, to one that filters itself and files every lead.

The form itself was never broken. It collected a name, an email and a message and it delivered them. What it did not do was any of the work that turns a message into a lead, so all of that stayed with me, mixed in with whatever else had arrived that day.

The moment a form is on the internet it stops being a form and becomes a URL that accepts posts from anybody, including software written specifically to abuse it. So the first question is not what to do with a submission. It is whether this submission has earned anything at all, and that has to be answered before an email is composed or a record is written.

The second constraint is the person. A form has to answer immediately, because somebody is sitting there watching a button spin. Anything the automation wants to do slowly has to happen without making them wait for it.

Concretely: the form posts to an n8n webhook. The first node checks a field that is hidden on the page. If anything is in it, the workflow answers 400 and stops there. If it is empty, the next node checks that the name, the email and the message are all actually present, and answers 400 if any of them is not. Only past both gates does a code node build the two emails: the notification to me, carrying the visitor's own address as the reply-to so answering is one keystroke and not a copy and paste, and the confirmation to the visitor. Both leave through Resend. At the same moment the submission is posted into my CRM as its own event, and the webhook answers the browser.

Ten nodes. This is the smallest automation on this page by some distance, and it is the one I would build first for almost anybody, because it sits on the single point where strangers become leads.

There is a text field on that form that is present in the page and invisible on it. A person will never type into it, because a person cannot see it. Automated software does not look at the page at all. It reads the form, finds every field in it, and fills them all in, because filling everything is how you get past a form you do not understand.

So the check is not "does this look like spam." It is "did you fill in the field that only a machine would have found." One node, no service, no score, no blocklist, and it never has to make a judgement call about a real human being. And it runs before anything else, because the cheapest spam to handle is the spam you never process.

I have also taken a honeypot back out of a form, on this very site, for exactly the reason you would expect once you have seen it happen. Password managers and browser autofill read the markup the same way the bots do. They find a field, decide it looks like one they know, and helpfully fill it in on the visitor's behalf. The visitor sees nothing, presses send, and gets silently rejected as a bot.

That form leans on a challenge widget and server-side validation instead. Which is the actual lesson worth taking from this build: the hidden field is free and it is excellent, right up to the moment somebody's browser starts being helpful. Name it carefully, and think about what a password manager will make of the name you chose.

The validation node hands off to four nodes side by side rather than in a chain. The notification, the confirmation, the CRM event and the answer to the browser all leave at the same moment. That matters most for the last one: a form that sits thinking for two seconds while it talks to a CRM feels broken to the person waiting, even while it is working perfectly.

And the CRM call is deliberately allowed to fail. It has a five second limit and it is set to carry on regardless, so if the CRM is slow or down, the lead still reaches my inbox and the visitor still gets their confirmation. A lead I have to file by hand later is an annoyance. A lead that never arrived is gone.

Every other case here was built for somebody else. This one runs on my own site, on my own n8n, into my own CRM, and if it breaks it breaks for me first and I find out because a week goes quiet. That is the only honest way to sell an automation to anybody: put it on the part of your own business you cannot afford to lose.

It is also the smallest build on this page, which is the point. Most of what I do for people is not enormous. It is one gap, closed properly, at the place where the money actually enters.