A common function of contact forms is to send the contact message not only to the site owner but also to the person who sent the contact request. What are good measures to protect against the form being used as a spamming tool by an automated script that submits it millions of times with different email addresses?

I can think of several approaches, but each one also has a downside or is not very effective.

  • CAPTCHAs can be broken too easily nowadays and are a hassle for the human submitter.
  • Rate limiting (only n submits per IP per day) won't help against a distributed script and may hinder proxied users.
  • Spam detection may generate false positives and if it's resource-intensive will make the site susceptible to DDOS attacks.

Each measure makes it harder/more resource intensive for an attacker though so he might just look elsewhere. How prevalent is comment-form spam? Do I have to worry about it?

  • 1
    reCaptcha still do a very good job these days. No thing more easy to go through for a real user than that check box.
    – billc.cn
    Jan 15 '16 at 18:38

You're right that allowing arbitrary, unauthenticated internet users to control both the content and the recipient of email messages sent by your web service (i.e. your website's "contact us" form) is a bad idea, and a potentially attractive target for spammers.

If it is important to you to:

  • enable the user to specify a recipient for the message; and
  • send a message to that recipient upon submission of the form,

then I suggest you at least prevent the user controlling the content of the message.

Why not take the sort of approach that GNU Mailman takes when it receives a subscription request? That is, send a confirmation email first, along the lines:

You, or somebody pretending to be you, submitted a message to use using the contact form on our website. This came from [IP ADDRESS] and gave your email as the sender's email address. If you made this submission, please click [HERE], or reply to this email keeping the subject line intact, to confirm your contact form submission, and we will read your submission and reply in due course. If you did not send us a message via our contact form, please ignore this message.

You could rate-limit this so that it permits no more than one anonymous submission to a given email address per (week|month|year|whatever), with the timer being reset if the user confirms as per the above instructions. That would discourage trolls from using the form to nuisance innocent people by causing them to be sent spurious confirmation messages.

In any case, only once the submitter of the contact form has been verified to have access to the email account submitted, should the contents of the message submitted be made visible to the user of that email account.

  • This has the drawback that any kind of structure that the form offered will be lost. E.g. you can't make your users enter certain "mandatory fields" or the like.
    – fgysin
    Jun 13 '16 at 13:31
  • @fgysin, I disagree. Essentially what I was proposing is that a submitted form should go into a quarantine queue. If the user follows the confirmation instructions within a defined time period (say 48h), then the submitted form is forwarded to the site owner (and, perhaps, to the email address given by the submitter). If the user does not follow the confirmation instructions within that time period, then the submitted form is deleted from the queue. None of that prevents the submitted form from its retaining structure or mandatory fields. Jun 13 '16 at 14:06
  • @sampablokuper: Ah right, I misunderstood that. In that case I have no objections. :)
    – fgysin
    Jun 13 '16 at 14:07

Allow me a partial answer based on previous experience in systems administration: Yes, it is reasonably prevalent, and you have to worry about it.

As politically incorrect as it might sound: Check if you can geographically define your user base (where are the people you wish to do business with?), and rate limit everyone else via GeoIP lookups.

  • Great thought and may solve many use cases for local businesses and such. But there is still a better solution to be found. Nov 9 '20 at 20:46

AKISMET is an interesting alternative. Is like a spam filter, but outsourced and that combines the knowledge it accumulates from many sites to better protect yours from SPAM.

While it is mostly used to protect wordpress comments (I´ve used it and I really dont remember asingle false positive or spam passing the filter), its API could be used for any other thing: https://akismet.com/development/

You submit the contact data detail to their API and they will give you a positive or negative answer for it. There are APIs for reporting false positives and false negatives.

There are some privacy concers, of course, to be considered here, since they will receive your contact data. However, is an option that could be considered.

Another suggestion is to use it in combination with the ones that you already mentioned: If there are too many contacts from the same IP, submit the contact for akismet for checking.

  • I don't think this answer relates really to the question. Jan 8 '16 at 17:55
  • 1
    AKISMET can be used for contact forms, even it is more broadly used to comment boxes. How exactly is not related to the question?. I´ll fix the link to the API that could be used.
    – CristianTM
    Jan 8 '16 at 17:57
  • 2
    Then maybe you should more describe how the software can actually help instead of given some rough description (spam filter) and let the user dig through the website to find out how this is useful for contact forms. Jan 8 '16 at 18:00
  • 2
    @SteffenUllrich Akismet could immediately flag contact form entries that appear to be spam and prevent them from being sent at all, until reviewed, or apply different rules to limit abuse. It's definitely an interesting idea.
    – Xander
    Jan 8 '16 at 18:41
  • 1
    @NeilSmithline - The use of AKISMET suggested in this answer has really nothing to do with email addresses. A spammer will specify a (theoretically) valid email addresses to receive the spam, and the "Spam" is in the "Message" field of the contact form. Whether a contact form submission is potentially "Spam" cannot be determined by the destination email address, which really belongs to an innocent person that will receive the spam message. Here, AKISMET is used to examine the content of the message associated with the contact form submission to try to determine if it is spam or not. Jan 8 '16 at 21:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.