I build websites for my clients, and I enjoy it. But I came to this work as a systems developer, and that is still how I think.
Every website I build sits on top of systems that keep it running, measure it honestly, and make sure a customer's message gets where it needs to go. More and more, I build those systems myself.
Upveyor was the first one I named. It watches every site I manage: uptime, visitors, contact activity, and AI visibility. Today I am naming the second.
VuLead is the mail relay and spam blocker behind every contact form I build. The name says what it does. View the lead: the real message from a real customer, without the clutter of everything that tried to get in alongside it.
It has been running since late July, handling every form message on every site I manage. This is the story of how it got here, including the mistakes, and one sender who kept trying to get through. She found one last gap while I was writing this post.
What VuLead Started With
From the beginning, every message passed through several layers before it reached a client:
- A hidden trap field that only bots fill in.
- A list of blocked email addresses.
- A check for throwaway email domains.
- Limits on how many messages one site or one visitor can send, plus a block list.
- An AI check that reads each message and decides whether it is spam.
- An alert to me whenever something gets blocked.
That sounds thorough. It still had problems, and I found them the way you always find problems: by using it.
The First Mistake Was Mine
I sent a test message from my own phone, and VuLead marked it as spam.
The AI check was judging more than the message. It was weighing the sender's name, business, and email domain too. I changed it to judge only what the person wrote. A message with a name and a phone number and nothing else now counts as a real call-back request, because that is exactly what it is.
Before trusting the change, I ran it against real past messages. It stopped flagging the real ones and still caught every sales pitch.
The Sender Who Kept Coming Back
Regular readers have met her already. She is the designer from In The Field 015 who kept pitching website redesigns through my clients' contact forms.
Every attempt used a new email address and a new IP address. One thing never changed: the phone number.
So VuLead now remembers each spammer's email and phone. When the same person shows up on a second client's site, every address and number they have used gets blocked across all of them. While building it, I caught that it would have blocked my own test number too, so that is excluded.
A Problem Nobody Would Have Seen
While I was in there, I found something worse. Every message had been logging the server's address instead of the visitor's.
That meant the per-visitor limit was not limiting visitors at all. Because every message looked like it came from the same place, one busy afternoon could have tripped that limit and shut off contact forms on about twenty client sites at once. I fixed it on fourteen forms across thirteen sites.
No client ever saw that problem. That is the point of finding it first.
What Clients See
Clients see their real leads by default in their portal, with spam one click away if they want to look. My test messages never show up for them under any filter.
Password resets and account invitations from a site's admin area also go through VuLead now. They skip the AI spam check, since a system message is not a sales pitch, but every other protection still applies.
The Crash I Found In A Customer's Shop
In late September, I was testing a client's contact form while standing in their shop, and it broke. If someone typed their own email address into the message itself, the form crashed, on every site.
It was fixed that day. I would rather find that in a shop with the owner watching than have a customer find it alone.
Submitted Is Not The Same As Delivered
One client's analytics showed nine form submissions in a week. Only four reached the inbox. Of the other five, one was spam, one was a bot, and one was a real visitor who saw an error three times.
That real visitor is the one that bothered me. So I changed all twelve sites with contact forms:
The analytics now count a message as delivered only when it reaches the inbox.
Every failed submission is saved to a private log, including what the visitor typed, so a real message is never lost.
"Form Submissions" is now labeled "Submit Attempts," because that is what it counted all along.
This is where VuLead and Upveyor meet. Upveyor reports what VuLead delivers, so the number a client sees is the number of real messages that reached them.
Seventeen Tries
In October, I blocked that designer's entire company domain, on top of her two email addresses and her phone number.
Her record from August 3 through that block: seventeen attempts across two client sites. None of them reached a client.
Then She Tried Again
While I was writing this post, one got through.
With her email addresses, her domain, and her phone number all blocked, she submitted a client's contact form with only her name. No email, no phone. There was nothing left for VuLead to match against her record, and a name by itself did not read as spam, so it went through to the client.
It did no real harm. A message with no way to reply is a dead end, for her and for the client. But it showed me a gap: some of my forms did not require a way to get back in touch with the person.
Less than an hour later, the gap was closed. Every contact form now requires a phone number or an email address, and if there is no phone number, the email is required. A message with no way to reply is not a lead, and VuLead will not deliver one again.
Even after I started writing this, the system had to change. That is how it should work.
I am honestly thinking about sending her an email to thank her for helping me improve it.
Systems, Not Just Websites
A website is the part people see. The systems behind it decide whether it works: whether the site stays up, whether the numbers are honest, whether a customer's message reaches the business that needs it.
Upveyor and VuLead are two of those systems. I built them because the standard tools were built for someone else's business, and because a client should not have to wonder whether their contact form is doing its one job.
The Foundation Connection
A contact form is part of a Digital Foundation, and a spam filter that blocks real customers is worse than spam. Every change in VuLead came from the same rule: stop the junk without losing a single real lead, and when something goes wrong, find it before a client does.
Some of these fixes came from my own mistakes, and one came from the most persistent spammer I have seen.
I am telling you about all of them, because a system you can trust is one where somebody admits what broke and shows you what changed.
