{"id":17306,"date":"2021-06-29T13:51:38","date_gmt":"2021-06-29T17:51:38","guid":{"rendered":"https:\/\/www.gravityforms.com\/?p=17306"},"modified":"2021-07-21T10:08:05","modified_gmt":"2021-07-21T14:08:05","slug":"how-to-prevent-spam-form-entries","status":"publish","type":"post","link":"https:\/\/www.gravityforms.com\/blog\/how-to-prevent-spam-form-entries\/","title":{"rendered":"How to… Prevent Spam Form Entries"},"content":{"rendered":"

\"PreventWhile forms are a necessary component of your website, getting spam submissions can be very frustrating and a huge drain on time and resources. However, the good news is that there are numerous strategies you can implement to protect your forms from spam entries.<\/p>\n

<\/p>\n

In this post, we\u2019ll talk about what form spam is, why form spam happens, and how you can prevent it. We’ll discuss Gravity Forms’ newest add-on, Google reCAPTCHA<\/a>, which supports Google reCAPTCHA v3, as well as some built-in features like honeypot and conditional logic. We’ll also share some news about the Gravity Forms Akismet Add-On, coming soon!<\/p>\n

Let’s get started…<\/p>\n

What Are Spam Form\u00a0Entries?<\/h2>\n

In layman\u2019s terms, spam form entries are any unwanted messages that end up in your WordPress admin and in your inbox through your website\u2019s forms.<\/p>\n

In technical terms, form spam happens when malicious internet users or bots submit unwanted messages using online forms with the end goal of phishing, hacking, scamming, or sending abusive messages.<\/p>\n

Why and How Does Form Spam Happen?<\/h2>\n

Form spam can happen in two ways: manual spamming and spam bots. Let\u2019s explain the differences between the two…<\/p>\n

Manual Spam<\/h3>\n

Manual form spam happens when companies hire people to fill out forms with information that\u2019s irrelevant to the article topic. Those are pretty generic looking comments and they often link back to the company that hired them.<\/p>\n

This type of spam is the most annoying and the most time-consuming as humans can get through all of the roadblocks that you decide to use to prevent spam form submissions. This type of spam is mostly associated with comment forms.<\/p>\n

Spambots<\/h3>\n

Spambots are more likely to hit the actual forms on your website. This includes contact forms, payment forms, application forms, and any other type of form you have on your site.<\/p>\n

Spambots will use the forms to submit information and will, in some cases, try to inject malicious scripts that can infect your website and your server. Spambots \u201cwork\u201d faster than humans and can often hit millions of websites per day.<\/p>\n

This type of spam is easier to combat as spam bots are unlikely to successfully get around various spam-preventing measures.<\/p>\n

How to Prevent Spam Form Entries With Gravity Forms<\/h2>\n

So now that you know what form spam is, let\u2019s talk about how you can actually prevent it.<\/p>\n

Gravity Forms has a selection of built-in anti-spam features and integrates with numerous add-ons that will help you to prevent spam form entries. Many of these add-ons and features can be used in conjuntion with each other to further protect your forms. Let’s take a look…<\/p>\n

Google reCAPTCHA 3<\/h2>\n

\"reCatchav3_Add-On\"<\/p>\n

reCAPTCHA has been around for quite a while now and the latest version is Google reCAPTCHA v3<\/a>. This method returns a score for each request which is based on how a user interacts with your website. It never interrupts your visitors so there is no friction involved. This allows you to run it whenever you want without the reCAPTCHA having a negative impact on your conversions.<\/p>\n

If you want to implement Google reCAPTCHA 3 on your website, Gravity Forms has you covered. We have a brand new reCAPTCHA Add-On<\/a> that supports Google reCAPTCHA v3. This add-on is available to all customers – simply install and configure the Google reCAPTCHA Add-On and use it to protect your forms from spam entries.<\/p>\n

reCAPTCHA v3 works by tracking actions on your site – Google then uses the data collected to identify possible spam or bot activity. All interactions on your site are given a score, with 1.0 being a likely good interaction, and 0.0 probably a bot.<\/p>\n

When a form entry is submitted, the Google reCAPTCHA score that is generated by the interaction is then stored with the form entry. Gravity Forms will compare the score to the threshold established in your settings, and if the entry is less than or equal to that threshold, the entry will be sent to spam.<\/p>\n

As mentioned, using Google reCAPTCHA v3 not only helps identify spam entries, it also ensures that your users aren\u2019t interrupted during a form submission, which could lead to higher conversion rates. However, it is important to note that the use of reCAPTCHA v3 requires the sending of user behavior information from your site pages to Google servers.<\/p>\n

Find out more information about Gravity Forms and Google reCAPTCHA v3<\/a>.<\/p>\n

Google reCAPTCHA 2<\/h2>\n

With Gravity Forms, you also have the option of adding Google reCAPTCHA v2 to your forms to help prevent spam entries. Google reCAPTCHA 2 offers several different methods for verifying your visitors are actual humans and not bots. You can choose between an invisible reCAPTCHA badge and the \u201cI\u2019m Not A Robot\u201d checkbox.<\/p>\n

The invisible reCAPTCHA badge works in the background which means your visitors don\u2019t have to click on a checkbox to confirm they\u2019re real users. Rather, the invisible badge is invoked directly when a user clicks on a button.<\/p>\n

\"InvisableThe \u201cI\u2019m not a robot\u201d checkbox requires user interaction. They have to check the box to confirm they are real users. The user is then passed immediately or they have to complete additional verification such as checking all the squares that contain a car on an image.<\/p>\n

\"reCAPTCHA\"For more information on Google reCAPTCHA v2, check out the Gravity Forms documentation<\/a>.<\/p>\n

Honeypot<\/h2>\n

\"Honeypot\"<\/p>\n

Using the honeypot spam protection technique is a good accessible alternative<\/a> to reCATPCHA.<\/p>\n

The honeypot method relies on an extra field that\u2019s added to your forms. The extra field is invisible to real users, thus it should be blank upon a legitimate submission of the form.<\/p>\n

Bots, on the other hand, can see it and are not smart enough to leave the field blank. As a result, if the field is filled, then the form submission will be ignored and you won\u2019t get a notification for it. Likewise, form entries will not be saved and add-ons won\u2019t process the submitted information.<\/p>\n

Gravity Forms has a built-in honeypot field that can be enabled for each individual form – for more information check out this documentation<\/a>.<\/p>\n

Conditional Logic On The Submit Button<\/h2>\n

\"ConditionalAside from dedicated spam-fighting features described above, there is another feature in Gravity Forms that can help you prevent spam form entries. The feature in question is conditional logic<\/a>.<\/p>\n

For example, you can add a simple question to your form that a human visitor can easily answer but a bot couldn\u2019t. Then, enable the conditional logic for the submit button to only display if the question was answered correctly.<\/p>\n

Here are some examples of simple questions you could ask:<\/p>\n