How you can stop fake Form submissions

Website forms tend to have the usual Name, Email, Phone number and so on, on them.  If a form on your website doesn’t have certain features enabled, you can end up getting a heck of a lot of spam going through them.  One after the other… after the other.. and so on.

This can be the same for Comments in blogs too (unless they are simply disabled).

Other areas of “form submission abuse” can come from login screens, reset passwords and so on.  They all send out emails from your host, or through your email server, but if it’s done many many MANY times, it can cause all kinds of problems.

Your host bar stop your emails going out if you are unknowingly sending out 100s and 100s of them.  But it can also bring your website down.

So how do you stop it?  It’s actually quite easy to do.  There are a number of ways.  One is a “honey pot” trap, which can come with Form plugins like Gravity Forms.  But another which will slow down to a stop, is the “I’m not a robot”, though these can also be a problem.  The one we prefer is Cloudflare’s “Turnstile”.

Google’s Recaptcha tool, if it’s one that demands the user interacts, is a checkbox that then animates.  Sometimes it just does that and gives a tick, and off you go; but not always.  Sometimes it can be a real pain in the… neck.  This is because it sometimes asks you to click all the busses.  Simple.  No.  As sometimes these images vanish and load more, slowly you down even more.  These often produce a bad result as after you have finished it’s process, it says “Sorry try again”, even if you have checked all the correct boxes.

The second one is where it has a kind of “puzzle” of one photo broken into segments, and you have to check all those segments where the item is within it.  Again, not always foolproof.

These are the reason we are not fans of it.  Too much in the way just puts people off too much.
Cloudflare’s Turnstile is different.  There are no busses!!  It’s just a checkbox.  Sometimes it auto completes, sometimes not.  But it’s a checkbox and that’s it.  It does all the other work behind the scenes.  It’s way more user focused, and quick.  But still blocks the nasties….

Visit Cloudflare’s Turnstile page here for details.

Adding these to a WordPress Website is relatively straight forward.  Either with a Google Account, or a Cloudflare account.  The only negative with Turnstile is you can only have up to 10 per widget account.  And you dont’ see the list of domains in each account, until you go into the Widget.
So if you have 5 Widgets, which account is this domain in….?

That said, once done, it’s done.  It should never need accessing again.

So next time you get bombarded with emails about passwords, or logins or “rubbish emails” through your form – consider that layer.  If you are unsure, just get in touch with us.

All the above are free tools.  Google and Cloudflare do not charge for them.