Skip to main content
Felix_Habenicht
Felix_Habenicht
Level 1
June 14, 2019
Question

Spam Record (Honeypot and Captcha doesn't work)

  • June 14, 2019
  • 1 reply
  • 2436 views

Hi all,

Unfortunately we have a lot of spam attacks. We already set up a honeypot field and also use a captcha field, but the spam go also through.


At the moment we use a smartlist which are delete all leads without a captcha token.
Anyway the system has to create "every minute" a lead and deleted it after that again. It's blow the database for a moment and also takes performance of the system.

I have also the feeling that the spammer takes the embed form link for do their spam attacks. So that the captcha javascript solution doesn't work.

I think, it would be create idea to block a general IP for all marketing activities.

Do you have similiar experiences? Or do you have maybe a better solution?

Thanks a lot
Felix

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

1 reply

SanfordWhiteman
SanfordWhiteman
Level 10
June 14, 2019

To start, it doesn't sound like you've implemented reCAPTCHA correctly. 

You *must* validate the reCAPTCHA user response (the "fingerprint" generated on the client side) against Google's servers. You don't just check to see if the fingerprint exists on the form fill activity.

And it doesn't matter if someone bypasses JS entirely, because the whole *idea* is that without executing the reCAPTCHA JS, they will always send an invalid fingerprint, thus you know they're malicious.

(The honeypot, on the other hand, has never been useful and needs to be taken out of everybody's toolbox. It made no sense from the start against malicious attacks.)

    Terms & ConditionsAccessibility statement

    Loading footer...