I posted about this on the Support page for the plugin, but figured I'd post here now, too -- I'm getting a lot of spam from the plugin Contact Form 7, and I was wondering what my options were for validating incoming messages for this plugin. Rather than installing yet another plugin, it would be great if I could do something within functions.php, or even something within one of Contact Form 7's php files to prevent this from happening. Is this possible?

An example of the kind of spam I'm getting would be something like:

loans for bad credit guaranteed <a href="http:/redacted">loans for people with bad credit</a> online loans bad credit [url=http://redacted[/url]

I believe there is some kind of cross-site scripting going on in an effort to store third party back links on my site. I tried preventing this with Javascript but realized that wouldn't fix it, and also was told in another post to always validate/secure against spam server-side rather than client-side.

  • 1
    A good start is to use Contact Form 7 Honeypot (wordpress.org/plugins/contact-form-7-honeypot) that adds a hidden text field. then human users doesn't see the difference and automatic spamer fill the field and is stopped. – Kaperto Aug 9 '18 at 15:39
  • Thanks -- somebody else suggested Honeypot, too. I kind of wanted to avoid another plugin, but I guess I'll try it out, although I don't think they are entering text in manually. I think it's some kind of script. Would Honeypot still be able to prevent this? – coffeebot Aug 9 '18 at 15:41
  • Should I have posted this to Stack Overflow? – coffeebot Aug 9 '18 at 17:15

Contact Form 7 has support for Akismet, and reCaptcha; check the docs. Hidden fields are not useful, IMHO; they are still visible in the page source to a 'scraper'. (Neither are 'questions' and some other techniques.)

The only useful thing that I have found is to add some Javascript to the form that senses human interaction: adding functions that look for on-click and/or on-focus of required fields. Bots have a difficult time with JS, although it is possible a targeted-to-your-specific-form spammer might be able to bypass that. But that is a highly-targeted attack.

I wrote a plugin that adds the on-click/on-focus sensing to CF7 forms: "FormSpammerTrap for Contact Form 7". The form 'target' is modified to submit to a 'honeytrap' site, unless an on-click/on-focus is sensed on a required field - that resets the form 'target' to normal. A simple shortcode is used on the form to enable my plugins' technique.

This blocks a lot of spammers, but there is no perfect solution. I've found that a combination of techniques: Akismet, reCaptcha, and my technique will catch a lot of (but not all) spam.

  • Thanks for the tip. I'll check this out. Trying to find a coded example or to figure out if this is even possible by doing something in functions.php or even one of the contact form 7 files -- it's slightly comforting to hear you say that there is no perfect solution, but I've got Akismet and ReCaptcha, and I'm still getting roughly 50 spam messages a day. – coffeebot Aug 9 '18 at 17:13
  • 1
    The plugin I wrote has lots of code: settings/info page, finding the right CF object, processing of shortcode, etc. But the main process is to put JS code that changes the 'target' of the form tag when a required field is on-focus/on-click. You are welcome to look into my plugin code if you want to 'roll your own'. A temporary solution is to make a new Contact page with your CF7 form, and delete the old one (or change it to redirect to a honeyhole somewhere). Thanks for the vote/accept. DM me via my formspammertrap.com site if you have questions. – Rick Hellewell Aug 9 '18 at 19:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.