Spam from not existing form

  • Resolved handmadehome

    (@handmadehome)


    2 months, 4 weeks ago

    Hi, can you help me please to stop spam from the form?

    I tried my best, but I can’t find a way to stop it. I have modern anti-spam protection and Akismet anti-spam protection enabled, and I tried all kind of captcha with maximum protection.

    But when I visited my Google Captcha account, I noticed that there are no entries in statistics. And it’s so weird because it looks like this spam form is not existing anymore. It looks like spam form submissions go from another copy of the form. I wouldn’t wonder if I had a staging website… but I don’t have it.

    I tried to move form into trash, cleared the cache, but that didn’t prevent spam.?????

    Then I renamed the title. But I’m still receiving emails with an old(!?) title version:

    The old title in emails:

    More other as you can see from screenshot above, submission page URL is website home page. But I have never had this form on this page. How is this possible?

    Here is also report from Mailgun:

    Sender’s IPs accordingly belong to Mailgun:

    • This topic was modified 2 months, 4 weeks ago by handmadehome.
    • This topic was modified 2 months, 4 weeks ago by handmadehome.

    The page I need help with: [log in to see the link]

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Support Ralden Souza

    (@rsouzaam)

    Hi @handmadehome,

    Thanks for reaching out!

    Regarding the spam issue, I noticed from the page source that you’re using WP Rocket. JavaScript optimizations in WP Rocket might be interfering with Google reCAPTCHA. I recommend adjusting WP Rocket settings by following our guide here to prevent issues.

    For the form notification subject, you can update this by opening your form in the Form Builder and navigating to Settings ? Notifications. From there, you’ll find the option to edit the Email Subject Line.

    Regarding the page URL in form notification emails, some server settings may only show the domain instead of the full URL of a page. I recommend testing this with another form to check if the Page URL will display the full URL of the page or just the site URL.

    Alternatively, you can share your form with us to check its settings. If needed, you can export your form following this tutorial, which includes helpful screenshots.

    I hope this helps! Let me know if you have any further questions.

    Thread Starter handmadehome

    (@handmadehome)

    Hi @rsouzaam,

    Thanks for your reply!

    I’ve adjusted WP Rocket setting. But spam doesn’t stop??

    For the form notification subject, you can update this by opening your form in the Form Builder and navigating to Settings ? Notifications. From there, you’ll find the option to edit the Email Subject Line.

    I renamed Email Subject Line and cleared website cache. My test message comes with updated Email Subject Line, meanwhile spam messages have an old Email Subject Line.

    Regarding the page URL in form notification emails, some server settings may only show the domain instead of the full URL of a page. I recommend testing this with another form to check if the Page URL will display the full URL of the page or just the site URL.

    I use this form only on Product Pages (“Send Message” button): https://www.shop.handmadehome.me/product/lullaby-crystallized-sculpture-moonlight-collection/ I tested it and I receive full page URL in email. So it looks like spam goes from home page, but I don’t have any WPForm on this page.

    I wonder if I move the form to the trash and clear cache, would it be possible it’s still able to send spam? In my case, moving to trash doesn’t help. Since I don’t have a staging website, would it be possible that spammers somehow use an old copy of this form? ??

    • This reply was modified 2 months, 3 weeks ago by handmadehome.
    Plugin Support Ralden Souza

    (@rsouzaam)

    Hi @handmadehome,

    Thanks for the details!

    Inspecting the page source of your homepage, it seems the notifications originate from form ID 21477 within a popup created with the Popup Maker plugin. Here’s a screenshot.

    To resolve this issue, I recommend reviewing the popups configured in the Popup Maker plugin. You could try disabling popup ID 21485 to see if that resolves the problem.

    I hope this helps!

    Plugin Support Ralden Souza

    (@rsouzaam)

    Hi @handmadehome,

    We haven’t heard back from you in a few days, so I’m going to go ahead and close this thread for now. But if you’d like us to assist further, please feel welcome to continue the conversation.

    Thanks!

Viewing 4 replies - 1 through 4 (of 4 total)
  • You must be logged in to reply to this topic.