Enquiry Form Spamming

[5iron2]

Hi,

We run a website that has an enquiry form and have recently started to receive a lot of unsavoury spam enquiries.

Our web developer has suggested Captcha but looking at it, it doesnt seem to be every desirable solution.

I know this topic has been covered before, but just wondered what the latest thinking is to deal with this problem, especially solutions that are invisible to the website users.

All comments will be welcome.

 

[Faevilangel]

captcha is the best solution but make sure it's a readable version. Also look into hidden fields. It's a field in your contact form that the end user cannot see but catches robots.

 

[MartBrooks]

If you're not willing to use Captcha, then perhaps don't have a form? Give an email address people can send to, and stick that email address behind a layer of filtering.

 

[Astaroth]

There are different methods you can use from random simple questions (what is 1 + 1) to javascript completing hidden fields etc.

With what ever you do you will lose some genuine customer enquiries as well as the spammers.

A reasonable idea can be too look at page request & response times (time taken for the form to be completed basically) and block any that are in too short a time for a human to have typed in the details (taking into consideration autocomplete)

Of cause when you can get people to work for $1 an hour spamming forums, forms, blogs etc, sometimes spam is human generated and all of these things will fail

 

[MikeJ]

I used a hidden field on a website, and it's completley stopped spam. Call the field something like "email address". The robot will fill it in, as it won't realise it's hidden.

Then in your code, dump any entry that's filled that field in.

 

[akirk]

Agree that there are a mixture of options - in terms of captchas we tend to use re-captcha - like what they are doing with old books... but as mentioned above you can't avoid humans being employed to spam you

Alasdair

 

[fisicx]

Agree that hidden fields and simple questions block most of the bots.

Another trick if you have a telephone field is to look for 0000 and filter that out.

You can also block any message with 'script' , 'http' and variants thereof.

I send them off to a virus riddled pop-up nightmare site.

 

[DavidGiant]

I agree with what most people have been saying here. Avoid the captcha.

Using a hidden field can work.

I prefer simple logic puzzles or type 'this' solutions.

What is 1+1?
What is bigger, an elephant or an ant?
Is fire hot or cold?
Please type 'human'

All will defeat the vast majority of bots. They are also very user friendly.

Similarly your developer could create a filter. Give him the spam messages you have been receiving and he could flag key words. If the form detects the message don't send it.

 

[UKSBD]

It can be quite fun when they are manual.

I get great pleasure from checking my approval database, seeing the junk listings that someone has gone to the trouble of listing, and then deleting in it.

It makes my day when it looks as though someone has spent a few hours adding multiple listings and I just delete them with a click

 

[FreelanceSoftwareDeveloper]

Avoid reCaptcha, yes it works the best, but that's because they tend to be incredibly hard for humans to read too! I've seen some where I have had to refresh them 2-3 times to get one I can figure out

 

[akirk]

There is a lot of thinking needed around forms etc. - it is one of the points where you open up your website and allow others to push data into you - always a security risk...

consider for example Form Keys - worth putting in - validates that entry is coming from the same website as the form...

Alasdair

 

[shugied]

Avoid reCaptcha, yes it works the best, but that's because they tend to be incredibly hard for humans to read too! I've seen some where I have had to refresh them 2-3 times to get one I can figure out

I find it really annoying, if it doesn't work first time I'm often inclined to forget that site, unless is does something I really can't get anywhere else.

Simple, amusing, questions are good, especially ones that require some knowledge about the country that you wish to get your responses from; few of the poor souls doing form entry are going to bother looking up, for example, the name of the last British PM. I assume though that most people in the UK would know that, perhaps some don't!

 

[mit74]

I used to use captchas but changed to a simple solution of putting 1 small input box below the submit button and another hidden text area. If any of these areas are filled in the form isnt sent and informs any person not to fill this box. Since using it I've been getting less spam than using the google capthca so it does work.

 

[Spock]

Not being very good with technical coding, on a regular html form how do you implement the questions field ie. what is 5 + 4?

Here's one we received yesterday:

TFEW9i <a href="http://royrjmxrzkop.com/">royrjmxrzkop</a>,
gokyoxtdddrn,
[link=http://szcxeepfnczy.com/]szcxeepfnczy[/link],
http://ryfiueawsqca.com/

We get lots of these but what is the point when the urls are just made up :|

 

[DavidGiant]

Do you know what programming language your website uses or what your form uses?

If your site is using PHP I could add it for you. It would only take a few moments, you just need to PM me your contact form.

In basic terms, when the form is being made, you need to create 2 random numbers between 1 and 5. When the form is submitted you add these 2 numbers and compare them against what the user put in. If the number is incorrect they are sent back to the form.

 

[Spock]

Hi David. The pages are asp but are generally html coding. I guess I could add a php form in an iframe?

 

[maxh]

We use a hidden CAPTCHA and very rarely get any spam. The worst we had was a human spammer who would send ~30 quotes a day through our system. We ended up having to bar several IP addresses to be rid of him

 

[mit74]

Not being very good with technical coding, on a regular html form how do you implement the questions field ie. what is 5 + 4?

Here's one we received yesterday:

TFEW9i <a href="http://royrjmxrzkop.com/">royrjmxrzkop</a>,
gokyoxtdddrn,
[link=http://szcxeepfnczy.com/]szcxeepfnczy[/link],
http://ryfiueawsqca.com/

We get lots of these but what is the point when the urls are just made up :|

I would get this looked at as soon as possible. Your HTML tags aren't being stripped from these emails which poses a security risk to your email server. I'm not sure if ASP if vulnerable like PHP but worth getting someone to check it over and they can sort your capthca out as well.

 

[DavidGiant]

Hi David. The pages are asp but are generally html coding. I guess I could add a php form in an iframe?

No, you would need to delve into ASP and do things on that end unfortunately. Should only be < 30 minutes work for the right developer.

 

[Spock]

I've just found www.emailmeform.com which seems like a pretty good solution. It allows you to generate a custom form and then gives you the code to put on your website

 

[DavidGiant]

If you are looking for a third party solution this also works really well.

http://wufoo.com/

 

[Spock]

It seems both those solutions go through their system so they only allow 100 or 200 enquiries a month on the free plan. Enough for most businesses I guess.