Form Spam Really Getting Frustrating – ByPassing Required Fields!

Hello @whyknott

I am sorry to hear about the issue you’re facing. Thank you for reaching out to us.

I’m starting to doubt forminator and it’s coding but also not counting out that the Theme could have something to do with it.

?

I can understand your concerns and it is not as easy to fight spam as it seems. Forminator implements some countermeasures that can be used out of the box, however, building a full spam filtering mechanism within Forminator will be as similar to building an actual Spam filtering plugin with all the Spam filtering techniques/rules.

Spam submissions are a wide problem and some bad elements somehow find ways to bypass security measures and cause spam as the website traffic increases it also attracts serious spammers. Unfortunately, there is no “absolute bulletproof” solution for this, but there are still some ways it can be avoided as much as possible.

I see that you’ve already tried multiple ways to avoid it, in addition to what you’ve already tried can you please confirm if you also tried our integration with CleanTalk Anti Spam?

Ref: https://wpmudev.com/docs/wpmu-dev-plugins/forminator/#cleantalk-anti-spam

If not, you can integrate Forminator with CleanTalk which should help you further strengthen the submission wall. Apart from that, I also noticed that you have an Email field on the contact form – so, Forminator also provides a way out of the box to validate emails using Clearout email validation, Ref: https://wpmudev.com/docs/wpmu-dev-plugins/forminator/#clearout-email-validation you can try these methods and check if they help you to reduce the spam submissions further.

Hope this helps.

Kind Regards,
Saurabh

I’ve integrated clearout and still keep getting spam. I have Phone number set as required and each spam submission they skipped adding a phone number!!! How is that possible? Also clearout doesn’t seem to be helping unless it’s extremely bogus. I continue to block IP address after IP address but that’s not helping. It’s like catching 1 fish in a school of 1000s. Do you recommend a service that can scour a website for loopholes in code? Again, my clients site shows as clean for malware but there has to be something causing it. This form is also connected to Zapier webhook connecting to LassoCRM. Perhaps that connection is opening a door for spammers? I’m at my wits end.

Hello @whyknott

I tested your form on my end, to see how it works however I couldn’t submit the form even using the valid information, it just shows something went wrong on all my tires.

It seems something is conflicting with the Javascript code since I found this Javascript error in the console logs:
typeError: l(...).intlTelInput is not a function

At this moment its not possible to submit the form on the front page, so looks like the spammers using a different method for submitting, maybe the site has actually been hacked.

My suggestion is to contact your hosting provider and ask them to malware scan on the hosting level, as security plugins can’t scan all the files and detect all kinds of threats.

This form is also connected to Zapier webhook connecting to LassoCRM. Perhaps that connection is opening a door for spammers? I’m at my wits end.

I don’t think the Zapier integration is causing issues but you can also try removing it.

Kind Regards
Amin

Hi Thanks for sharing the error. The website is not hacked. My clients site is clean on the server side. I just had them run a full server side scan! It’s actually an issue with the code your team wrote for me to handle the reformatting of the phone number field so it correctly is output without spaces in order to be compatible with Google ads conversion tracking!!!! Your team set up the code as an mu-plugin.

The error “typeError: l(…).intlTelInput is not a function” typically occurs when the intlTelInput (International Telephone Input) JavaScript library is either not loaded correctly, or there is a conflict with how it is being called. This library is commonly used for formatting international telephone numbers in forms, and it’s possible your Forminator form is using it for a phone number field.

I don’t think your team properly enqueued and initialized the scripting so it’s creating a loophole.

Hi @whyknott

I reviewed your form again and I can’t see the reCAPTCHA on the form (hidden or checkbox) its Javascript is added to the page but it doesn’t work properly right now. You may try double-checking your reCAPTCHA setup to make sure its working, to set it up you need first add your API keys in forminator settings, then add the captcha field to your form, and select the matching version.
https://wpmudev.com/docs/wpmu-dev-plugins/forminator/#captcha-field

Additionally, I would suggest using Cloudflare, if you have a lot of bot visitors/requests its firewall can significantly help mitigate it. You can find more information about that here in this article (its free plan should be good for your case):
https://www.cloudflare.com/en-gb/application-services/products/bot-management/

I’m afraid we no longer help with custom codes and its out of the scope of our support, you’ll need to hire a developer to provide the required custom code for you. WordPress provides a jobs directory here https://jobs.wordpress.net/, if you need further advice about it, feel free to email [email protected].

Subject: ATTN: WPMU DEV support – wp.org

Kind Regards,
Amin

So how do you expect me to continue using forminator alongside Google Ads Conversion Tracking? The AMERICAN USA phone numbers must have no spaces and the little plus symbol and look like this +5554443333 in order for Google ads to be able to track them. Without the forminator custom code I can’t track phone numbers in Google ads. The mu-plugin that was created by your team is clearly what is causing the loophole and spam so you help me write the code and provide the solution and now that it basically is causing problems, you throw me under the bus and no longer “support” or can help me with this? Wow. Thanks.

Hi @whyknott

Hope this message finds you well, and sorry to hear you are experiencing this issue.

After checking I found the code we shared with you to commit the E.164 format here:

https://www.ads-software.com/support/topic/google-tag-manager-and-e-164-phone-number-format/

In version 1.36.0 which was released a couple of days ago, one of the improvements includes an update for the library Forminator used to validate the Phone field. After testing the code I can confirm the error is caused by the last update. However, this might not be the cause for the SPAM you are getting, since the code only formats the phone field and adds filters that run in the server side before the submission.

As explained by my colleague, any new code or custom is out of our support scope, however, I notified our devs team about the code not working due to the new version, and they will provide further information, and if they will update the code or not. Since they work on very complex issues, getting a reply from them could take longer than usual, we will back to this ticket once we get an update from them.

Best regards,
Laura

Thank you. I just removed the mu-plugin E-164 formatting code for now. I’m not sure what to do with Google’s Enhanced conversion tracking setup though because in order for Google’s enhanced conversions to use the phone number field it needs to be E164 format. I might be able to work with their tech support to use a different piece of data instead of the phone number. Their support articles and team say that Email and Phone are the two more reliable fields to use for Google’s Enhanced Conversion Tracking to provide the best results but perhaps they can recommend a different approach, I don’t know.

It would be awesome if Forminator offered the ability to specify in the settings for the phone number field how we want the data to be formatted after submission to accommodate the E164 format and 3rd-party ad tracking software (Like Google’s Enhanced Conversion Tracking when running Google ads), rather than having to add custom code.

I’d actually prefer the E164 code you guys wrote to be formatted as a function that I can add to my snippets plugin for ease of management. I don’t like it as an mu-plugin because I don’t have quick access to it without having to login to the hosting provider or using FTP.

Thanks!

Hello @whyknott

Hope you’re doing well today! Thank you for the reply.

Looking at the issue, can you please confirm if you were able to try the Beehive Google Tag Manager integration with Forminator to see if that helps in this case?

Ref: https://wpmudev.com/docs/wpmu-dev-plugins/beehive/#integrations

Regarding the phone number settings to accommodate Google Enhance Conversion Tracking standards, I have created a feature request about this based on your feedback. This will enable the Forminator team to explore further what you’ve suggested to see if a feature as such could be included in the upcoming versions. However, I will not be able to share an exact ETA when it will be released.

Regarding the console error due to the custom snippet, we are still working on it as the issue is not always replicated, and rather intermittent on our lab environment. That said, we will keep you posted as soon as more information from the developers is available.

Thank you for your patience while we are checking it further.

Kind Regards,
Saurabh

Hi @whyknott,

Since we can acknowledge this will be looked at in a future update as a feature, I’ll mark it as resolved for now.

For any new feature updates, you can get notifications on our progress by subscribing to our roadmap at https://wpmudev.com/roadmap/

Once new versions are released, any pertinent changes will be described in the changelog, which you can find at:

https://www.ads-software.com/plugins/forminator/#developers

Kind Regards,

Nithin