Thread

I’ve been getting spam entries and have had a terrible time validating them.  It seems like nothing I do (client-side OR server-side) has been able to prevent them. All spam entries just enter “0” for all fields, so I even tried hacking this module to set an error message if any field’s value is “0”, and that works for my testing, but the submissions are still getting through.

That said, I just noticed that all spam submissions don’t have the “template” field filled out when viewing the entries. I attached a screenshot of the Entries page to illustrate…note the spam submission (see how the fields are 0’s starting at 2nd from the right…couldn’t show more because of resolution restrictions here) and how the “template” column is empty. This makes me think that these submissions are somehow bypassing the freeform system completely?

Any ideas how this could be happening? Any other info I can provide?

Also, I already posted this on the solspace forums which is why I’m posting here.

if you guess or harvest the action_id for freeform I imagine you could post anything you wanted to to the server, especially if certain security settings were disabled in ExpressionEngine (XID hash jumps immediately to mind).

Ender: thanks for the reply! So what would you recommend?

MCrittenden,

There is also a Freeform Spam extension available. Maybe that will help