Bot Butcher

What is Bot Butcher?

Bot Butcher is an anti-spam API for website contact forms provided by Hillside Lab Inc.; it helps developers to classify messages before they reach email inboxes, customer relationship systems, or ticketing systems.

It analyzes the content of the messages submitted by visitors, takes into account the website’s domain name to understand the context, and returns a structured result indicating whether the message is spam or not.

Main functions

• Context classification: Form messages are sent to a classification interface; the website domain name can be included to help the system distinguish between legitimate inquiries, promotional content, and automated spam messages.
• Structured determination: The interface returns a boolean value indicating whether the message is spam, along with the message_id and status code; based on this information, the program can decide to allow, isolate, mark, or reject the message.
• History query: By using the message_id, it is possible to retrieve information such as the time at which a message was processed, its original content, the domain name, metadata, and the classification result, which facilitates the troubleshooting of workflows.
• Custom metadata: Requests can include JSON metadata to store identifiers for forms, tenants, activities, or internal records.
• Experience without verification codes: The verification takes place on the server side, and visitors are not required to identify images or complete any interactive challenges; this approach helps to reduce the barriers to submitting forms.
• Multi-site use: The pricing plan includes unlimited forms per website; it is possible to protect multiple projects under the same account, but the usage volume is still calculated on an account-wide basis.
• Privacy control: Users can opt to prevent messages from being saved and to stop them from being used for training; neither of these options incurs any additional cost at present.

Input and output

Access process

1. Complete registration verification using an email address, or log in with a supported third-party account and agree to the terms of service.
2. Obtain the API key in your account, and store it in server-side environment variables or a key management system.
3. The message is collected on the backend of the contact form, with the domain and metadata added as needed.
4. Send a request to the classification interface, include the key in the request headers, and then parse the returned spam value and message_id.
5. Set rules for approval, isolation, manual review, or rejection based on business risks; do not rely solely on automatic decisions to permanently delete messages.
6. Use test messages to simulate normal inquiries, sales attempts, messages in different languages, empty content, and abnormal requests, in order to verify the error handling and timeout strategies.
7. After going live, monitor the number of requests, false positives, and costs, and set according to privacy requirements whether messages should be saved and whether they can be used for training.

Development language and implementation approach

The document provides example requests using cURL, Python, JavaScript, TypeScript, Java, C# and Rust; the core functionalities can also be utilized by other backend languages that are capable of sending network requests and parsing JSON.

These code snippets are examples of interface calls and should not be considered as the complete, official SDK that has been released.

Suitable for users and scenarios

• Developers of corporate websites and standalone sites that need to reduce spam emails from contact forms.
• I manage websites for multiple clients and am looking for a website development team that can share the same anti-spam interface.
• Marketing and sales teams that need to screen potential customers before they enter the customer relationship system.
• Platform developers who create website generators, vertical SaaS solutions, or multi-tenant form products.
• Product teams hope to prevent visitors from having to enter traditional verification codes, while still maintaining the ability of the server side to assess risks.

Product advantages

• The input and output structures of the interface are simple, making it easy to integrate into existing form backends and message processing pipelines.
• The domain context helps the model understand the meaning of the same sentence on different websites.
• The options of not saving messages and prohibiting training provide more precise data control for sensitive operations.
• There is no limit on the number of forms; multiple sites can be managed centrally with regard to calls and costs.
• Set a free or low fixed fee at a reduced usage level, which is suitable for testing the effectiveness using actual data traffic first.

Capacity limits and usage restrictions

• Any automatic classification may lead to errors; important sales leads should be placed in a separate area or reviewed manually, rather than being deleted permanently.
• The accuracy rate stated on the official website is based on their own manual scoring criteria; it does not come from independent third-party tests. The actual performance depends on the language, industry, and distribution of the messages.
• Domain is an optional field; however, omitting it reduces the context available. According to the official privacy statement, this results in a decrease of about 6% in accuracy during testing.
• The interface is responsible for sending the form data to external services; a compliance assessment must be carried out before processing sensitive, medical, financial, or regulated information.
• Invalid domain names may still receive classification results and suggestions, but the accuracy of those results could be reduced; therefore, the caller should verify the input.
• Network timeouts, quota issues, or authentication errors should not be considered equivalent to normal messages or spam; applications must have separate strategies in place for handling such failures.
• At present, the specific name of the model, the fixed response time, the service level agreement, or any independent security audit reports are not available.

Prices and billing

The tier is determined based on the number of requests per month; the actual bill may also be affected by taxes, the account’s location, or settlement settings, so it is necessary to refer to the account’s settlement page for accurate information.

The terms state that any fees that have been paid or incurred prior to the termination of the subscription are non-refundable, and cancellation does not exempt one from the cumulative fees already paid.

Privacy, security, and data processing

• It is possible to choose not to save messages during configuration, so that the submitted content does not end up in the history of stored messages.
• It is possible to select messages whose transmission is to be prohibited for use in model training; this option does not incur any additional cost at the moment.
• The domain can be omitted to reduce the shared website context, but this comes at the cost of a trade-off between privacy and classification accuracy.
• The privacy statement indicates that the data is stored using methods that comply with HIPAA requirements, but using this service does not automatically ensure that the customer’s business meets all medical compliance obligations.
• The privacy policy states that account details, device information, and browsing data may be collected, with the necessary information being provided to service providers.
• Payment cards are processed by payment processors, and Bot Butcher states that it does not collect card information directly.
• API keys must be stored on the server side; they cannot be embedded in public web pages, mobile front-ends, or public code repositories.
• Before submission, irrelevant personal data should be removed, and the purpose of processing, as well as the rules regarding processing and storage by third parties, should be specified in one’s privacy policy.

API, code, and open-source status

Summary

Bot Butcher is suitable for integrating the detection of spam in contact forms into the server-side workflow, especially for teams that need multi-site management, low interaction overhead, and configurable data handling methods.

Before official integration, one should use their own real message set to assess the likelihood of errors, and at the same time implement mechanisms for failure recovery, manual review, key protection, privacy disclosure, and cost monitoring.