Wordpress - Contact Form Spam

[A Party Shop]

Our Party Blog is built with Wordpress.

We seem to have eradicated comment spam but every time we make a new blog post, a wave of spam then arrives via our contact form.

I know it's from the contact form as it says [your-subject] and at the bottom of the email "This mail is sent via contact form on A Party Shop Blog http://www.apartyshop.co.uk/blog"

Any suggestions on how we can rid this PITA?

 

[Gensmann]

One trick we used in the old days was to include an empty hidden field in the contact form. Then if the hidden field included some content it was probably spam and we discarded that entry.

Most spambots tries to fill out every form field and they cannot know that the specific hidden field should be empty.

That demands some local development and implementation, but i'm sure there's a plugin out there which does something similar. Most contact form plugins in the wordpress repository has some kind of spam protection.

 

[JonathanSEO]

You are using Contact Form 7.

Sign up for Akismet (paid tool to prevent comment spam) and you can integrate it with the form to prevent it.

http://contactform7.com/spam-filtering-with-akismet/

I had the same problem on a very similar site

 

[Faevilangel]

As Jonathon said, install Akismet and a lot will die off.

There are settings to change which will help as well:

settings > discussion

tick 'Automatically close comments on articles older than 14 days ' change 14 to something like 28.

tick 'Comment author must have a previously approved comment'

Common moderation:

hold a comment in the queue if it contains 2 links, change to 1

 

[iksol]

You need to use a CAPTCHA.

There are plenty of Wordpress plugins that implement a CAPTCHA for forms.

 

[sb1design]

As has been stated already so far, which ever contact form plugin you are using, make sure you have added a Captcha to it, (either via the options within the particular plugin or by installing an addon).

Furthermore, on installing Wordpress you should have Akismet ready to activate. Follow the instructions to get your API, this will also help minimize Spam.

Together these options will combat spam very efficiently indeed.

 

[Exemplaryhost]

the easiest way would be Captcha. this has been around for a very long time but is very effective, but i hate them and i am sure many others do to. For one of my clients i had installed a captcha plugin that would be a simple maths question. Its definitely much more user friendly then the distorted letters.

 

[fisicx]

Use this form: http://wordpress.org/plugins/quick-contact-form/

On the form settings page check the spam filter box. No more spam (almost).

Askimet won't block contact form spam, it's for blog comment only.

 

[Faevilangel]

Use this form: http://wordpress.org/plugins/quick-contact-form/

On the form settings page check the spam filter box. No more spam (almost).

Askimet won't block contact form spam, it's for blog comment only.

There are addon's for CF7 etc which makes Akismet work

 

[JonathanSEO]

Askimet won't block contact form spam, it's for blog comment only.

Zis is incorrect. Akismet works seamlessly with Contact Form 7. Other than Gravity Forms it's the best contact form out there and it is free. Plus the OP is already using CF7, which is the recommended form the theme developer. No point uninstalling it and having to use another one.

There are addon's for CF7 etc which makes Akismet work

No add ons required, it's inbuilt just add the akismet tags to your contact forms like akismet:author and akismet:author_email and you are spam free.

 

[fisicx]

Akismet works seamlessly with Contact Form 7.

Except it isn't free: http://akismet.com/plans/

CF7 and gravity forms are not the best. They just happen to be very popular.

 

[JonathanSEO]

Except it isn't free: http://akismet.com/plans/

CF7 and gravity forms are not the best. They just happen to be very popular.

Worth it though for spam protection. Especially if you run a blog that gets comments. I couldn't run a website without it.

And they are easily the best, I used a ton of contact forms in the WP repository, nothing comes close.

 

[sb1design]

Except it isn't free: Akismet

So that people are not put off using Akismet, I just want to make the point that it is free for non-commercial use. I am aware that this is a business forum, however those that run a blog or small website could still qualify for the free plan.

 

[deadpixel]

as mentioned above captcha is a fairly good solution but its not always great from a usability pov. I would try the empty field trick but you'll probably need this custom coded.

 

[Nuno]

The Invisible Captcha plugin does this. (Not sure it does it for forms.)

(PS Fisicx was plugging his own plugin. Quite a good form, and all his...)

 

[andygambles]

Cloudflare will do a decent job of stopping spammers ever reaching your website www.cloudflare.com

 

[Geoffsimons]

Hi

I had this last week after sending out some newsletters and emails to my audience. I asked my technical team. they responded.
They added a second level Captcha form on the comments area by users -
This worked immediately. Last weekend I had 1340 comments, this weekend I had 1!!
Thanks to my technical team.

 

[amac]

Our Party Blog is built with Wordpress.

We seem to have eradicated comment spam but every time we make a new blog post, a wave of spam then arrives via our contact form.

I know it's from the contact form as it says [your-subject] and at the bottom of the email "This mail is sent via contact form on A Party Shop Blog http://www.apartyshop.co.uk/blog"

Any suggestions on how we can rid this PITA?

Definitely set a question that humans can answer that bots will find tricky. This can be done quite easily adding fields. Recaptcha is useful but I think Q&A is the best way forward.

 

[JonathanSEO]

Definitely set a question that humans can answer that bots will find tricky. This can be done quite easily adding fields. Recaptcha is useful but I think Q&A is the best way forward.

Just use akismet as it removes the need for more fields which is either a potential area the form fails or causes someone to leave.

Also unrelated but I just read your homepage:

"Founded in May 2013, MacGregor Industries is synonymous with industrial expertise and financial strength. The company drives operational improvement, strategy, financing, and restructuring – and executes industrial transactions.

As an active owner, MacGregor Industries is a powerhouse in the development of strong companies – with an ultimate goal of creating value for shareholders, customers, employees, and society in general."

LOL. Find a new copywriter.

 

[Basi Heating]

Questions generally work better than image based captchas to eradicate spam emails, (eg is the sun hot or cold?) Image based captchas can be bypassed with captcha bypass services that are integrated into the tools that these email form spammers use.

Having said that there seems to be a new generation of captcha out now where the user has to move pieces around to complete an image, a bit like doing a jigsaw. These are likely to be very effective at keeping spammers out. Also do a google search for "qaptcha" this looks like a very user friendly way to eliminate spam bots. The user has to unlock the form before they can submit it by sliding a button in the same way you unlock an Iphone.

 

[Freelancealot]

Hi,

We use the SI CAPTCHA Anti-Spam Wordpress plugin for comments, login form, etc. Simple to set up ... and it's free!

Cheers,

Tracy

 

[adamo]

Use a Captcha WP plugin. Probably the easiest and most effective way of dealing with it.

 

[JMaddox]

Image based captchas can be bypassed with captcha bypass services that are integrated into the tools that these email form spammers use.

Agreed. Unfortunately, as time passes, people find a way to bypass these standard security procedures.

Yes, questions work, but I also like the new captcha service where you have to drag and drop images- a nice touch.

 

[VanillaOnlineAccountancy]

By no means an IT expert but I've used the Honeypot plug in the past and it works well.

 

[Alan]

You need to use a CAPTCHA.

Nooooo. CAPTCHA is a horrible user experience, and it isn't spam-bot proof in-fact most have been broken.

Askimet won't block contact form spam, it's for blog comment only.

I am afraid it does and works very effectively, you can use it with contact form 7, grunion contact form, and JetPack contact form (which is grunion).

There are addon's for CF7 etc which makes Akismet work

You don't need an add on for contact form 7, it is built in and a simple box tick (full syntax here http://contactform7.com/spam-filtering-with-akismet/ )


As you can tell we are fans of Akismet, so much so we pay for an enterprise licence and give it away to our fully managed WordPress clients.

 

[fisicx]

I am afraid it does and works very effectively, you can use it with contact form 7, grunion contact form, and JetPack contact form (which is grunion).

I know this now and am suitably humbled.

I'm looking at askiment integration with my contact form plugin - it's not easy.

But I agree, avoid captcha where ever possible. It's got so that I and many people I know don't even bother with websites that use them. Same as those that force me to agree to their use of cookies.

 

[Alan]

I'm looking at askiment integration with my contact form plugin - it's not easy.

Using the API is hard, but if the akismet plugin is installed and on, then most of the work is done.

Download the 'grunion contact form' (as used in JetPack by Automattic, the same developers as Akismet), and have a search the code for akismet, you will see that is isn't too hard (for an expert developer).

 

[fisicx]

....you will see that is isn't too hard (for an expert developer).

Well that's me buggered then!

 

[fisicx]

Right...

After a whole bunch of research I'd like to correct a myth. Akismet does NOT filter contact form spam. What you have to do is convert your form fields into a wordpress comment and then call Aksimet to run its filters.

http://blog.akismet.com/2013/09/09/akismet-and-your-wordpress-contact-forms/

 

[Alan]

It does,

specifically Grunion contact Form, Jet Pack contact form (without doing anything) and Contact Form 7 (if you specify akismet in the contact form 7 field, http://contactform7.com/spam-filtering-with-akismet/)

It doesn't with any old contact form, e.g. the ones that come pre-bundled with premium themes.

 

[fisicx]

It does

I agree it does. But it's not filtering the form, it converts the form inputs to comment fields and then uses the Akismet database. There is a whole bunch of code built into the forms to make this work. I know, I've just spent most of the day trying to unravel Grunion end extract the bit that talks to Akismet.