Lots of Spam

I came here to complain about the same. I have been using wpforms for a couple of years now; and suddenly (over the past one month) there is a steep increase in spambot spam through the wpforms contact form.

I have enabled recaptcha, but the spammers seem to be routinely bypassing it.

The spam is originating from a single company / spambot since the name field has a specific pattern in all these spam mails :

DickXMVI
SdvillBedHE
elSeeVaxNZ
BeelineAluncQE
TysonFuckyND

Notice the lack of any spaces and the last few characters are always in upper case. Also, the email IDs used are usually either Gmail IDs or a .ru email ID.

The spam has increased very significantly over the past couple of days and we had to disable the contact forms completely. Is the recaptcha working at all ? Is there any other solution to this ?

Butterfruit,
I don’t know which plugins you use for WordPress security, but I’d recommend the “Shield” plugin. I use it for my clients’ sites and they rarely get spam from their forms.
It has a setting (in Integrations) to block spam in WPForms (specifically) without using any Captcha.

It’s also a great security plugin!

I came to the forums to check this very thing. Recaptcha is enabled but spam is getting through. With the recaptcha we should not need another plugin. I’m not actually seeing any sign the google recaptcha is loading when I look at page view.

Hey @windspeed @starhorsepax2 @butterfruit – Thanks for reaching out!

We’re sorry to hear that you’ve encountered spam issues.

If you’re still having spam with reCAPTCHA enabled, you can consider increasing the security level of the reCAPTCHA integration on your site.

For v2 reCAPTCHA, you can do this by going to your reCAPTCHA account. Then in the settings of your current integration, you can adjust the Security Preference slider.

For v3 reCAPTCHA, you can adjust the settings in your WordPress admin area by going to WPForms > Settings > reCAPTCHA. In this Score Threshold field, you can increase the score to a higher number for stricter security.

And if you’d prefer not to use reCAPTCHA, we have another anti-spam protection feature, hCaptcha. This is a good option if you’d prefer not to sign up for Google’s reCAPTCHA service. Within your forms, hCaptcha will display a checkbox asking users to prove they’re human (much like Google’s v2 Checkbox reCAPTCHA). We have a detailed guide for setting up hCaptcha.

Alternatively, you can consider the third-party plugins such as WordPress Zero Spam or Spam protection, AntiSpam, FireWall by CleanTalk which work out of the box to protect your forms against spam.

Hope this helps!

@kendawes Thanks for taking out the time to share the tools you’re using with the community ??

Hello all,
I’ve just changed to hCaptcha and will give it a go for a while to see if it gets any better. I do this because I could not find where to edit the security strength for Google reCAPTCHA (I was looking for a slider, is that right?)
I will come back in a few days to give you an update.
Thanks

Hey @windspeed,

Sure – please let me know how it goes. In the meantime, you can also take a look at the reCAPTCHA documentation for the security preference slider.

Kindly,

A quick update. No spam at all since installing hCaptcha 4 days ago. Not sure if this means its a better program or I just didn’t install reCaprcha correctly the first time.
Thanks

Hey @windspeed – Happy to hear that the spam issue is resolved now. In case you have more questions, please feel free to reach out.

Kindly,

Hello all, I am hopping in on the topic to ask for advice with the same issue. I’ve tried using reCaptcha v2 and incresing the Security Slider preference to maximum, as well as v3 but it didn’t help. I also decided to try my luck in registering the bot’s name (so far always been the same name but different e-mails) as a profanity by following the WPForms tutorial “How to Block Form Submissions Containing Profanity” and creating an extra plugin with the php code to block it. It worked succesfully for me because when i tried putting the bot name that i usually receive couple hundred times a day, the form blocked me for profanity. I thought I’ve succeeded but on the next day i got spammed again. So the bot has somehow discovered a way to block my profanity filter AND the Captcha Settings… I’d be very grateful for any help and tips!

Thanks in advance!

Hey @ahrm2 – I apologize for the trouble!

When you get a chance, please create a new support ticket and I’ll be happy to assist you over there.

Kindly,