Ascue

Ascue (say “ASK-you”) asks every contact form message a few questions before it ever asks you anything. Each message gets one of four labels:

• Lead: a real person who wants to buy, book or hire, or a customer who needs help. Delivered to your inbox right away.

• Pitch: someone selling to you (SEO, outsourcing, guest posts, lead lists). Held for your weekly digest.

• Spam: bots, gibberish, scams and link drops. Blocked and kept for 30 days in case you need it.

• Ask me: Ascue isn’t sure. Delivered to your inbox marked “Ascue wasn’t sure”; one click confirms or corrects it.

Ascue never deletes a message, and when in doubt it delivers. Visitors never see a CAPTCHA: filtering happens after they press Send.

Invisible bot protection. When a visitor starts filling in a form, their browser quietly solves a tiny puzzle from your own site, taking a fraction of a second. Scripts that post forms without a browser, or faster than a person could type, fail it.

If a bot starts hammering your form, Ascue switches on attack protection and blocks it without using your monthly checks.

This plugin connects your WordPress forms to the Ascue service. It works with:

• Contact Form 7

• WPForms (Lite and Pro)

• Gravity Forms

• Elementor Pro forms

How it works

• A visitor submits your form. The form plugin validates it and runs its usual spam checks as before.

• The plugin sends the message to Ascue and waits at most 4 seconds.

• If Ascue accepts it, Ascue sorts it and emails real leads to the inbox you set in your Ascue dashboard, and your form plugin skips its own notification to you. The visitor sees your form’s normal success message.

• If Ascue doesn’t answer within 4 seconds, returns an error, or no site key is set, the plugin does nothing and your form sends its normal email. A visitor’s message is never lost because of Ascue.

Emails your form sends to the visitor, such as confirmations and autoresponders, are not changed. Submissions that include uploaded files keep your form’s normal email, so attachments always reach you.

Ascue is a paid service with a free tier of 50 messages a month for one site. dev for plans.

External services

dev (or another API URL you set in Settings → Ascue), so Ascue can sort them into leads, pitches and spam and email the real ones to you.

When data is sent

• Each time a visitor submits a form from a supported form plugin that is enabled in Settings → Ascue, after the form plugin has validated it, if a site key is saved and the form would send a notification email to you. Submissions with uploaded files are not sent.

• When an administrator presses Test connection in Settings → Ascue. This sends a short test message that is not emailed to anyone.

What is sent

• The values the visitor entered in the form: the message, name, email address, subject and the other fields, with their labels. Passwords, CAPTCHA, honeypot and consent fields are left out.

• The visitor’s IP address, as your server saw it, and the X-Forwarded-For header when your site is behind a proxy or CDN such as Cloudflare, so Ascue can find the real address.

• The visitor’s browser user agent, the short text every browser sends to say what it is.

• The outcome of the invisible browser check (passed, failed, missing, expired or reused) and, when it passed, how many seconds the visitor took to send the form.

• Your site key, which identifies your site to Ascue.

• The plugin and WordPress version numbers.

Ascue uses the IP address and user agent only to spot spam bots attacking your form: a form sent by a script instead of a browser, or a burst of spam from the same address. It never stores the IP address itself, only a keyed hash of it, and deletes the hash and the user agent within 7 days. To stop sending them, add add_filter( 'ascue_send_visitor', '__return_false' ); to your theme or a small plugin.

The browser check’s puzzle comes from your own site ( /wp-json/ascue/v1/challenge ) and is checked on your own server; the visitor’s browser never contacts Ascue. To turn the check off, add add_filter( 'ascue_browser_check', '__return_false' );.

The plugin does not send uploaded files.

Ascue deletes message text after 30 days unless you opt in to help improve Ascue, and keeps only labels, scores and fingerprints after that. Ascue uses TypeSafe AI as a subprocessor to classify messages.

• Terms of Service: https://ascue.dev/terms

• Privacy Policy: https://ascue.dev/privacy