Spammers are using a contact form on our Wordpress site to spam us, but I can't find which form it is. It's (presumably) from our site because it has the standard footer "This e-mail was sent from a contact form on OURSITENAME (http://www.OURSITENAME.com)". The subject was just 'Contact Form Submission' so I changed the subject line on our main contact form to something different and the spam's still coming through with the original subject line. So I know it's a different form, but to my knowledge it's the only one we've got which sends an email to us in this manner.

Under Dashboard > Contact, I have four forms. Our normal one, and two others which have different subject lines. So it must be somewhere else. I checked the message source and there's nothing in there to indicate where it came from.

Does anyone know how to track this down?

Thanks, Greg

  • First, see the letter source to find out the mail server sending spam. May be it's not yours, just using the widespread subject. Second, the question is not related to WordPress in any form.
    – Max Yudin
    Commented Mar 12, 2019 at 8:22
  • Does your contact form have CRSF tokens - might they be submitting a form without actually using your site? Can you see the contact form submissions in your web server logs?
    – Rup
    Commented Mar 12, 2019 at 10:27
  • 1
    Thanks for your replies Max and Rup. It's a Wordpress site. I checked the message source and compared with a legitimate form submission and spotted just one difference. It looks like the spam submissions are coming from a little used sister site which was cloned from an old version of our current site and thus had all of our site identification info still included (including the footer message). I've changed the wording on that page's form so I will be able to check now if that's where it's coming from. If so I'll add reCaptcha to that page too. Thanks for your help! Commented Mar 12, 2019 at 11:16


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.