Form Spam

Hi,

We are getting a ton of spam through our Contact Us form (link) - to the tune of 30 emails at a time. We added a ReCaptcha, but that doesn't seem to be helping at all. Is there a way to block an email domain, or something else we can do? I am brand new at this, so go easy on me! Sorry if this has been covered elsewhere - I couldn't find anything when I searched. 

Thanks,

Katie

Hi Katie ~ I'm experiencing the same thing. Did you find a solution, and if so - would you mind sharing?  My searches have also turned up nil in handling it. As a one-woman shop, I'll take all advice.

Thank you! 

Kate

Also having this problem on a client site. They are sending replies to Salesforce and receiving a lot of Spam even with reCaptcha .... would love to know if there's a good solution.

The usual steps to stop spam are to add a Captcha to forms, and avoid showing email addresses on webpages. 
 

If you have a ‘Captcha’ installed then the spam is being created by hand, not by bots. These are probably low paid humans in another country and so there is not a ‘solution’ to this. Depending on the severity and the way the form is being used, one workaround might be to write some code to add a field to the form that automatically logs the IP address of the user’s device. If you find that the spam is always being generated from the same range of IP addresses, you could then take steps to block these from visiting your site. 

Hi all, just joining in. We'd like to avoid this as well, but unsure of how to add a Captcha in the first place. Would anyone mind sharing how they added?

Thanks much!

5 hours ago, racheldesjardins said:

Would anyone mind sharing how they added?

Take a look at Adding Google reCAPTCHA to forms.

Any advice on how to take the next step and allow only 1 form submission per IP address, or block users based on their browser (I've been told Explorer pre V6)?  

If I'm using JS to implement Recaptcha V2 on an embeded form, can I try V3 or is it won't work with SQS? Thank you. 

Hi!

One thing that has worked for us in the past (other than Google reCAPTCHA) was to ask a simple question in the last form field that has to equal an exact letter, phrase or number (i.e. "What is 5 + 5?" or "What is the first letter of our company name, John Lynch Builder, LLC?"). This idea seemed a little silly, so we added an explanation "Please answer the following question to help us prevent spam from getting sent to our inbox:"

On 5/18/2021 at 6:30 PM, JohnLynchBuilderLLC said:

Hi!

One thing that has worked for us in the past (other than Google reCAPTCHA) was to ask a simple question in the last form field that has to equal an exact letter, phrase or number (i.e. "What is 5 + 5?" or "What is the first letter of our company name, John Lynch Builder, LLC?"). This idea seemed a little silly, so we added an explanation "Please answer the following question to help us prevent spam from getting sent to our inbox:"

John how do you do this with squarespace forms?

@paul2009 I receive a lot of, what seems to be, automated spams even though the site uses Captcha. I've added a screenshot of the emails I get. All the emails are exactly the same: the name is repeated twice, and there are arbitrary words in the form fields. Any idea how they're able to send this? I receive multiple emails every day. I don't know how I could filter these away... I wish Gmail filters supported regex. 🙂

2 hours ago, Arandano said:

I receive a lot of, what seems to be, automated spams even though the site uses Captcha.

I recommend you contact Squarespace Customer Care because the quoted email address is on a SPAM Blacklist. Squarespace Forms normally block form submissions when they include a blacklisted email address, but that obviously isn't happening here.

On 7/21/2021 at 6:34 PM, vjtk said:

John how do you do this with squarespace forms?

Did you find out how this works?

On 5/19/2021 at 1:30 AM, JohnLynchBuilderLLC said:

Hi!

One thing that has worked for us in the past (other than Google reCAPTCHA) was to ask a simple question in the last form field that has to equal an exact letter, phrase or number (i.e. "What is 5 + 5?" or "What is the first letter of our company name, John Lynch Builder, LLC?"). This idea seemed a little silly, so we added an explanation "Please answer the following question to help us prevent spam from getting sent to our inbox:"

Do you know how to do this?

2 hours ago, Aurora said:

Do you know how to [ask a simple question in the last form field]?

You can do this with a simple text field but it isn’t ideal and it will stop spam. The idea of this method, was that you could look at the submitted emails and manually delete any with the incorrect answer. However, you’ll find that some legitimate visitors incorrectly answer the question, and as lots of spam is generated by low paid humans, spam, as will answer the question correctly.

16 minutes ago, paul2009 said:

You can do this with a simple text field but it isn’t ideal and it will stop spam. The idea of this method, was that you could look at the submitted emails and manually delete any with the incorrect answer. However, you’ll find that some legitimate visitors incorrectly answer the question, and as lots of spam is generated by low paid humans, spam, as will answer the question correctly.

Thanks, Paul! Is there any other strategy than Google's reCAPTCHA that you can recommend at this point? (I'm not able to use Google for privacy reasons.)

1 hour ago, Aurora said:

Is there any other strategy than Google's reCAPTCHA that you can recommend at this point? (I'm not able to use Google for privacy reasons.)

It will depend on the privacy concerns (what are they?) and which risks you (or your client) are trying to mitigate by stopping spam submissions. If you can clarify what they are, the community may be able to suggest alternative approaches.

For example, are you/they trying to avoid the inconvenience of deleting lots of spam emails everyday or trying to prevent malware being opened?

If it helps:

• reCAPTCHA is not the only Google service built into Squarespace. You can't disable all the Google services - at least not easily.
• Squarespace forms are not suitable for sensitive personal information and neither is unencrypted email. 
• Squarespace forms can't contain code or images. They shouldn't contain malware unless they contain links and recipients click on them.
• There are alternatives to reCAPTCHA (like Turnstile) but Squarespace hasn't been built to integrate with these (yet).

Did this help? Please give feedback by clicking an icon below  ⬇️

I'm using JotForm now, much better spam tools including honeypot and logical CAPTCHA plus CSS tools to match with SS site

How to we "add a field to the form that automatically logs the IP address of the user’s device. If you find that the spam is always being generated from the same range of IP addresses, you could then take steps to block these from visiting your site. " How do we do this?