XF 2.0 Spamming the contact us form

[Booth]

I'm getting a few emails per day via the contact us form, all .ru accounts. They are managing to circumvent the captcha.

I've got all .ru accounts banned in my admin area but still these emails keep coming. Does the ban list not affect the contact us form?

 

[Ozzy47]

You might like this addon,

[OzzModz] Contact Us Spaminator

Sick and tired of your inbox getting flooded with spam coming from the "Contact Us" system on your xenforo install(s)? You've tried everything and still it persists? You even shut off the "Contact Us" form to guest visitors? You need the...

xenforo.com

And no, the banned emails are not prevented from using the contact us form.

 

[Booth]

You might like this addon,

[OzzModz] Contact Us Spaminator

Sick and tired of your inbox getting flooded with spam coming from the "Contact Us" system on your xenforo install(s)? You've tried everything and still it persists? You even shut off the "Contact Us" form to guest visitors? You need the...

xenforo.com

And no, the banned emails are not prevented from using the contact us form.

Thanks I'll have a look.

 

[toejam]

You can turn off contuct us for the unregistered groups.

 

[djbaxter]

You can turn off contuct us for the unregistered groups.

The problem with that is if a member forgets his/her password or can't login for some other reason that's often the only way they have to contact you.

 

[Ozzy47]

You can turn off contuct us for the unregistered groups.

You can, but that is a unsatisfactory way to deal with spam, you are only inconveniencing real legitimate people by doing that.

 

[toejam]

It is an option and its a way to eliminate email spam. I no longer recieve emails that my web site has been compromised.

 

[Rhodium]

If you have cloudflare, add a firewall rule like that:



I didn't received more spam since then.

 

[Booth]

You can turn off contuct us for the unregistered groups.

I need none members to be able to contact us if necessary. I think I'll add that plug-in, but it is a shame that by default, the same rules for registration don't apply to the contact form.

I'm finding that the same bots that are being blocked from registering are the same spamming the contact us form.

 

[Ozzy47]

but it is a shame that by default, the same rules for registration don't apply to the contact form.

There is a open suggestion for that,

Contact form should respect Banned Emails list

So I just finished migrating my site from vB 3.8 to XF. We went live with the DNS switch yesterday. This morning, I have seven emails from the contact form inviting me to explore a world of sexy photo galleries, russian brides, etc. I have a captcha in place, but apparently humans are...

xenforo.com

 

[Xon]

My (free) "Contact Us Threads" add-on implements a banned email list for the contact us form. With the option to silently discard contact us form entries if they are in the list (ie shadow banned).

[OzzModz] Contact Us Thread

When the Contact Us form is used, this add-on will create a thread in a specified forum. Associates the thread ownership with the logged in user or as a guest user, and uses a phrase to format the message contents. Notice: The Contact Us flood...

xenforo.com

 

[djbaxter]

@Xon What settings should be used to implement that banned email list?

 

[Xon]

It adds a section under the XenForo email ban list UI, that basically works exactly as the normal email ban list

 

[djbaxter]

Hmmm... any way to import the regular banned email list into that list?

Answering my own question, yes. Go to the regular banned email list and export.

Then go to the banned emails (contact) list and import what you just exported.

 

[drastic]

Can we just turn the form off entirely and unlink it? Or replace the link with a contact page node?

 

[Paul B]

Can we just turn the form off entirely and unlink it? Or replace the link with a contact page node?

You can do either of those.

 

[PJK]

If you have cloudflare, add a firewall rule like that:

View attachment 218911

I didn't received more spam since then.

I've done this too, thanks for the suggestion. The issue is that when people click Contact Us, it opens the contact form on the same page, it doesn't go to that URL. Therefore, users don't see the captcha unless they actually navigate to misc/contact.

 

[dethfire]

I've done this too, thanks for the suggestion. The issue is that when people click Contact Us, it opens the contact form on the same page, it doesn't go to that URL. Therefore, users don't see the captcha unless they actually navigate to misc/contact.

Must be a custom theme, because mine doesn't do this

 

[TPerry]

I think what he's referring to is it opens in in an overlay?
The only time I know it will do that is if you choose custom URL and then open in overlay in the default setup.
Otherwise, it should be using the default contact URL, unless the style has a special setting or a 3rd party add-on is being used.