Email spam trigger words: what SpamAssassin actually scores

Every "500 spam words to avoid" listicle is half wrong. SpamAssassin doesn't have a magic word list; it has a few hundred rules that score on patterns, context, and combinations. Knowing how the engine actually thinks lets you write effective subject lines without typing around imaginary tripwires.

If you want the broader content map, the content hub groups trigger phrases, MIME structure, plain-text alternatives, and accessibility checks into one guide.

How SpamAssassin scores content

Each rule has a name (HTML_IMAGE_ONLY_28, MISSING_HEADERS, etc.) and a numeric weight. A message's total score is the sum of triggered rules. Above 5.0 is typically marked spam; the threshold is configurable per receiver.

The phrases that actually score

Notice the pattern: most content rules require a combination of signals to fire. "Free" alone is fine. "FREE!!! Act now! Limited time!!" stacks five rules.

What the listicles get wrong

• "Click here" — not a trigger. Used in millions of legitimate emails daily.
• "Buy now" — fine in context. Triggers only when stacked with urgency phrases.
• "Cash" — neutral. Spam phrasings are more specific ("cash bonus," "cash prize").
• "Discount" — common in legitimate retail mail. Not scored.
• "Sale" — fine. Subject "50% OFF SALE!!!" is the problem, not "sale."

What you should actually avoid

1. ALL CAPS subjects. Even partial capitalization (>50%) triggers UPPERCASE_50_75.
2. Multiple exclamation marks in subject or first paragraph.
3. Stacked urgency phrases. "Act now," "limited time," "don't miss out" within the same paragraph.
4. Dollar amounts in the subject when paired with urgency. "$5,000 today!" hits multiple rules.
5. "You've won" / "You're a winner" — strongly weighted as common phishing pattern.

Structural problems you should care about more

Testing without guessing

1. Send your draft through WillItInbox. The content category breaks out every triggered rule with weights.
2. For raw SpamAssassin: pipe a test message through spamassassin -t and read the rule output.
3. Use mail-tester.com for a quick second opinion.
4. Iterate one variable at a time — change subject, re-test, then change body. Combined changes obscure cause and effect.

Additional guidance: Spam Trigger Words in 2026: The Myth That Won't Die

Spam trigger words barely matter in 2026. Modern filters — Gmail, Microsoft, Yahoo, and the corporate gateways — score your authentication, domain reputation, and recipient engagement first; the word "free" in a subject line contributes almost nothing to the verdict. Content still matters, but through link reputation, HTML structure, and image ratios, not through a forbidden-word list. Stop editing words. Start testing.

The "582 spam words to avoid" listicles keep ranking because they're easy to write. Here's what's actually true.

Where the myth came from

The myth isn't fabricated — it's archaeological. In the 2000s, spam filtering genuinely was content-first. Two technologies built the legend:

Bayesian filters learned word probabilities from corpora of spam and ham. If "viagra" appeared in 98% of spam and 0.1% of legitimate mail, its presence shifted the score hard. Words really were the signal — because spammers and legitimate senders were otherwise indistinguishable.

SpamAssassin, the open-source filter that still underpins a lot of mail infrastructure, scores messages as a sum of hundreds of rules — and yes, some rules are keyword rules. Real examples from the rule set:

score FREE_MONEY             1.8
score MONEY_BACK             0.5
score BODY_URI_ONLY          1.1
score HTML_IMAGE_RATIO_02    0.4

Look at those weights. A message trips spam at a score around 5.0. The scariest keyword rules in the entire corpus contribute 1–2 points, and most contribute fractions of one. Even in the era the myth comes from, no single word condemned you — and the word-based rules were the weakest rules in the system. Meanwhile RCVD_IN_BL (blocklist hit) style rules carried weights that dwarfed everything lexical.

The listicle writers looked at a scoring system where content was one input among hundreds and extracted the only part that's easy to turn into a listicle.

What replaced word lists: reputation-first filtering

Modern filtering at Gmail, Microsoft, and Yahoo is a layered pipeline, and the layers run roughly in this order:

1. Authentication. Does the mail pass SPF, DKIM, DMARC with alignment? Fail this as a bulk sender in 2026 and you don't get filtered — you get rejected with a permanent 5xx. (Gmail: 550 5.7.26 since November 2025; Microsoft: 550 5.7.515 since May 2025.)
2. Reputation. What does the sending domain's history look like — complaint rates, engagement, spam-trap hits, sending consistency? This is the dominant signal. Gmail's scoring is domain-reputation-first; Yahoo moved to domain-reputation-first scoring in April 2025.
3. Engagement. Do these recipients open, reply, move-to-inbox, or delete-without-reading? Gmail personalizes placement per user. The same message lands in Primary for one person and spam for another.
4. Content. Last, and least. A tiebreaker, a seasoning — and mostly not about individual words, as the next section covers.

The practical consequence: a sender with high domain reputation and strong engagement can write "FREE!!! Act now, limited time, 100% guaranteed" and land in the inbox. A sender with a torched reputation can write a haiku and land in spam. Every deliverability practitioner has watched both happen.

This is also why the real reasons emails land in spam are almost never word choice — they're authentication gaps, list quality, and complaint rates. And why the delivery vs. inbox placement gap tracks reputation, not vocabulary.

Where content still genuinely bites

Debunking the word-list myth doesn't mean content is irrelevant. It means content matters through different mechanisms. These are the ones that actually move verdicts:

URL and link-domain reputation

The single most important content signal in 2026 isn't in your text — it's in your links. Filters extract every domain in the message body and check each against blocklists and reputation systems. One poisoned domain — a link shortener on a blocklist, a shared tracking domain another customer abused, a redirect chain through a flagged host — can junk the message regardless of how clean your prose is. If you take one thing from this post: audit your links, not your adjectives.

Link shorteners

Public shorteners (bit.ly and friends) are heavily abused by phishers, so filters treat them with structural suspicion. There is no legitimate reason to shorten a link in email — the recipient never sees the URL until hover. Use full URLs on your own branded domain.

Image-only and image-heavy emails

An email that's one big image with no meaningful text is a classic spam evasion pattern (filters can't OCR as cheaply as spammers can generate). Image-heavy messages with thin text score worse everywhere and render worse everywhere. Keep a healthy text-to-image balance, and always include real HTML text.

HTML hygiene

Broken tags, Microsoft Word–exported markup, invisible text (white-on-white, 1px font), and text stuffed in HTML comments are all historical evasion techniques with rules written against them. Clean, simple, well-formed HTML from a real email builder passes without thinking about it.

Attachments

Unexpected attachments — especially .zip, .html, .iso, Office docs with macros — trigger sandbox detonation and quarantine at corporate gateways and deep suspicion at consumer providers. Marketing and cold mail should never carry attachments. Link to hosted content.

Deceptive patterns

Misleading subject lines ("Re: your invoice" when there is no invoice), fake reply-thread prefixes, spoofed display names. These don't trip keyword rules — they trip classifiers trained on user complaints, and they generate the complaints that torch your domain reputation. This is content hurting you through reputation, which is exactly the right mental model.

A worked example: same words, two outcomes

Concrete scenario. Two senders ship the same promotional email on the same day. Subject line: "FREE shipping — 50% off ends tonight!" By listicle logic, this message is radioactive: "FREE" in caps, exclamation point, urgency, a discount. Four trigger-word violations before the preview text.

Sender A sends from a domain with two years of clean history. SPF, DKIM, and DMARC aligned and enforced. Complaint rate at Gmail: 0.03%. Links point to their own domain, which appears on no blocklist. Their recipients open at high rates because the list is pure double opt-in. Result: inbox. The "FREE!!!" subject line does nothing, because the reputation layers already rendered their verdict before content was evaluated, and the content layer found clean links, balanced HTML, and a proper text part.

Sender B bought a list last quarter. DKIM passes but their complaint rate is 0.35%, they've hit spam traps, and their ESP's shared tracking domain took a blocklist hit last week from an unrelated customer's phishing-ish campaign. They nervously rewrite the subject to "A note about your recent order" — zero trigger words. Result: spam folder, and partly for a darkly ironic reason: the deceptive, unrelated-to-content subject line is itself a classifier signal, and the message still carries a blocklisted tracking domain in every link.

Same vocabulary spectrum, opposite outcomes — decided entirely by reputation, authentication, and link hygiene. This is not a thought experiment; any deliverability consultant with a book of clients has watched this exact A/B play out across a Black Friday weekend.

The listicle reader's takeaway would be "Sender B should have avoided spam words." Sender B avoided all of them. Sender B's problem was a purchased list and a poisoned tracking domain — both fixable, neither lexical.

Why the myth keeps selling

Three reasons the word lists survive every debunking. First, they're actionable-feeling: "remove these 12 words" is a task you can finish by lunch, while "rebuild your domain reputation over six weeks" is not. Second, confirmation bias: deliverability fluctuates constantly, so any change — including a useless one — gets credited when placement recovers for unrelated reasons. Third, the lists are unfalsifiable as written. If you remove "guarantee" and still hit spam, the listicle says you must have missed one of the other 570 words.

The tell: nobody selling a word list ever shows placement data. Senders who instrument their mail — seed tests, deliverability scores, Postmaster data — stop believing in word lists within a quarter, because they watch vocabulary changes do nothing while authentication fixes and list hygiene move the needle immediately.

The correct mental model: content is a multiplier, not a variable

Here's the framing that survives contact with reality:

Placement = reputation × content quality

• With high reputation, mediocre content still delivers. (Multiplier ≈ 1.)
• With high reputation, actively bad content — poisoned links, image-only, deceptive patterns — can drag you down. (Multiplier < 1.)
• With low reputation, no amount of content polish rescues you. (Multiplied by ~0.)

Content is a way to lose placement you earned, not a way to win placement you haven't. Nobody ever word-smithed their way out of a 0.4% complaint rate.

This also explains the cargo cult. The sender who "fixed deliverability by removing FREE from subject lines" actually changed five things that week — pruned the list, fixed DKIM, throttled volume — and credited the word. Correlation, a listicle, and a myth regenerated.

There's one legitimate, narrower debate worth having: whether aggressive sales language affects Gmail tab placement — Promotions vs. Primary. Even there, engagement signals dominate vocabulary. The mechanics are covered in getting from the Promotions tab to Primary, but spoiler: the answer is replies and reads, not synonyms for "discount."

What to do instead of word-list superstition

Test content objectively

Superstition survives because senders never measure content's actual contribution. Fix that. Send your real email through the free deliverability tester: it scores 70+ checks across five categories, and two of them exist precisely for this discussion — Content (20 points) and Links (10 points). The Content score catches structural issues (image ratio, HTML hygiene, missing plain-text part); the Links score checks every URL domain in your message against reputation sources. That second one is where content problems actually live in 2026.

Change one thing, retest, compare scores. That's how you replace folklore with instrumentation. If the Links score flags a domain, you found a problem a thousand word lists would never have caught.

Sandbox before you send

For template work, use an email sandbox to iterate on rendering and structure before anything touches real recipients. Broken HTML, missing alt text, a tracking pixel that rewrites weirdly — catch them in the sandbox, not in a campaign.

Fix the inputs that actually drive placement

In rough order of leverage:

1. Authentication at full strength (SPF, DKIM, DMARC aligned, enforced).
2. List quality — no traps, no dead addresses, no purchased data.
3. Complaint rate under 0.1% (Gmail's threshold) and one-click unsubscribe (RFC 8058) in place for bulk mail.
4. Engagement targeting — send more to people who open, less to people who don't.
5. Link-domain hygiene.
6. Then, if you have spare time, worry about the word "free."

One caveat for cold email

Cold outreach is the exception that keeps the myth limping along, because cold senders have no engagement history — so content and pattern-matching carry relatively more weight. But even there, the killers are structural: link domains, HTML fingerprint, sending patterns, and complaint rates. The cold email deliverability playbook covers what actually moves cold placement. It is not a thesaurus.

Before you go: if this post killed a superstition for you, prove it with your own mail. Send your next campaign through the email deliverability tester and read the Content and Links categories line by line — that pair of scores tells you more about your content risk than any spam-words list ever will.

The fastest check is not deleting every promotional word. Run the complete message through the deliverability tester, then use the header analyzer when MIME or required-field evidence needs isolated review.