Troubleshooting Spam Submissions

Convert Forms has several layers of spam protection. Below is a short overview of each one with a link to its full doc, followed by fixes for the spam problems we see most often in support.

Spam protection features

• Honeypot: adds a hidden field that bots fill in and people never see. On by default.
• Minimum Time to Submit: blocks submissions sent faster than a person could fill in the form. On by default. If you raised it and spam still gets through, see Spam still gets through after raising the time.
• Captcha: asks visitors to prove they're human before they submit. Choose from hCaptcha, Google reCAPTCHA, Cloudflare Turnstile, ALTCHA or the Math Captcha. Off until you add a captcha field to the form.
• CSRF Token Protection: rejects submissions that don't come from a page on your site, like bots that post straight to the form's submission URL. Off by default.
• Double Opt-in: adds new subscribers to your email list only after they confirm by email.
• Block email addresses or domains: rejects submissions from the addresses or domains you list.
• Block bad words: rejects submissions that contain the words you list.
• Restrict submissions based on IP: rejects submissions from the IP addresses you list.
• Custom validations: rejects submissions that break your own rules.
• Submission Context Tracking: records the IP address, user agent, device and more for every submission, so you can see what spam has in common.

Page caching can keep serving an old copy of the form after you change these settings, so clear your cache once you're done.

The captcha dashboard shows no activity

If your captcha provider's dashboard shows 0 requests while spam keeps arriving, the captcha isn't on the form. Entering the Site Key and Secret Key in Convert Forms' Options only makes the captcha available. You still have to add the captcha field to each form you want to protect, as shown in the hCaptcha, Google reCAPTCHA and Cloudflare Turnstile docs.

Real-looking names with unrelated email addresses

A common pattern on newsletter forms: the First Name field holds a full name, the Last Name field repeats it, and the email address has nothing to do with that name. This is usually subscription bombing. Bots sign real people's email addresses up to hundreds of lists at once, so the flood of welcome emails buries something important in the victim's inbox, like a bank or password alert.

That makes it worse than regular spam. The addresses belong to real people who never signed up, so your welcome emails and automations go to them, they mark you as spam, and your sender reputation drops.

The fix is to enable double opt-in in your email marketing task, so nobody joins your list until they confirm. If you use Brevo, see the Double Opt-In flow.

Spam sent by real people

Captchas, the honeypot and the time check stop bots. They can't stop a person typing into your form by hand. For this kind of spam, block what the submissions share: the same email domains, words or IP addresses. The next two sections show how to find that pattern.

Find patterns with Submission Context Tracking

Open a few spam submissions and compare the details Submission Context Tracking recorded for each. Two values give spam away most often:

• IP address: if the spam comes from the same IP or range, block it with the PHP script in Restrict Form Submissions Based on IP.
• User agent: a bot usually sends the same user agent string with every submission, so you can block that user agent too.

To block a user agent, add this to the form's PHP Scripts → Form Process section, and replace the example strings with the ones you see in your spam submissions:

// User agent strings, or parts of them, to block
$badAgents = [
	'python-requests',
	'HeadlessChrome'
];

// The error message shown when a submission is blocked
$error_message = 'Your submission has been blocked.';

$agent = $_SERVER['HTTP_USER_AGENT'] ?? '';

// Real browsers always send a user agent
if ($agent === '')
{
	throw new Exception($error_message);
}

foreach ($badAgents as $badAgent)
{
	if (stripos($agent, $badAgent) !== false)
	{
		throw new Exception($error_message);
	}
}

The script also blocks submissions with no user agent at all, since real browsers always send one.

Spam that follows a pattern

Sometimes the pattern is in the data itself: the same value in the first and last name fields, a link inside a name field, or text in an alphabet your visitors don't use. You can reject those submissions before they're saved with a custom validation in the form's PHP Scripts.

Still getting spam?

Export a few of the spam submissions from Components → Convert Forms → Submissions, with all their data and context, and send them to our support team. We'll look for the pattern and help you block it.