Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have a form on my site, created using Contact Form 7 with Captcha. Contents of the form when POSTed are being sent to a PHP script, the "action" attribute of the form is set to themes/<themename>/<filename>.php

We have been receiving a lot of spam, it seems that someone can handcraft the form and use it to send spam. In the processing script I check the HTTP_REFERRER, HTTP_SERVER to see if the request came in via our site, but those headers can also be manually crafted in. What steps do I need to undertake to stop the spam coming in?

Help is appreciated.

EDIT : Some more clarity. CF7 will POST the form data to my script at http://www.example.com/wp-content/themes/themename/script.php , that script is accessible . Someone can go to the page where my form is and copy the HTML, re-create the form on their local machine and start submitting the form to my script. How do I stop that?

share|improve this question
1  
You can use codex.wordpress.org/WordPress_Nonces –  Vinod Dalvi Feb 27 '13 at 7:24
    
@VinodDalvi: The form is created using Contact Form 7, and the data is being processed outside of CF7. How do I add a nonce field to the CF7 form and verify it inside my processing script? –  Anand Feb 27 '13 at 7:41
    
CF7 forms already have a nonce value... –  RRikesh Feb 27 '13 at 8:07
    
@rrikesh: I understand that, but in CF7 I have "send form data to alternative page" set. The spammers are directly POSTing to my script instead of going via the form on the site. –  Anand Feb 27 '13 at 8:09
1  
Why don't you hook the form using wpcf7_before_send_mail and add your PHP code to functions.php (since the script is already in your theme folder)? You won't lose any of CF7's abilities. –  RRikesh Feb 27 '13 at 9:22

3 Answers 3

up vote 1 down vote accepted

You must hook the form using wpcf7_before_send_mail and add your PHP code to functions.php (since the script is already in your theme folder)? You won't lose any of CF7's abilities.

function wpse_process_form( &WPCF7Object ){
  #process your form here
}

add_action('wpcf7_before_send_mail', 'wpse_process_form' );
share|improve this answer

even I faced this problem. This is what I finally did.

  1. Change the POST processing script's file name.
  2. In your forms, keep a hidden form element which is a dummy element, if this is being filled, then its a spammer!! So in your POST processing script, check if this dummy element is being posted - if it is, then its a spammer.
share|improve this answer

If you are looking for a solution that will detect spam without blocking legitimate users then Use akismet. There is simply no sure technical way to detect spam without inspecting the content itself. smart spammer will even load your page before sending the form.

The only technical solution that might work is to block IP ranges if you can identify the IPs from which you are getting most of the spam. You can also try to block known "bad" IPs by using project honeypot.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.