Thread

We have a live site that was getting hammered with spam, I found that secure mode was disabled on it.  When I enable it, you can’t submit to the forms at all.

There are two freeforms on the site, 1 - signup (single field to submit an email address) and 1 - contact form (just a few input fields and a message field).  When Secure Mode is enabled, I get the error message “You are not authorized to perform this action” regardless of what email address is use, logged in or not, cleared cookies, etc.

There is also a forum on this site which is being attacked like crazy.

Any ideas on why this would be happening? 

I’m using invisible captcha, blacklisted IP’s and domains etc, but the bots are getting right past all of it.

I also tried adding the hidden field “<input type=“hidden” name=“XID” value=”{XID_HASH}” />” as suggested in a another post but I still get the same error.

Are you using the latest version of freeform? I think freeform outputs it’s own XID hash so you shouldn’t need to include it yourself. After the page loads are you requesting anything else from EE (eg through ajax or an iframe)? Please post your freeform template code and I’ll have a look.

Hi Ralph,

Thanks so much for your reply!  I upgraded freeform to the latest and that fixed the issue - one of those “why didn’t I think of that” moments…  I appreciate your help!