+- Form Tools (https://forums.formtools.org)
+-- Forum: Form Tools (https://forums.formtools.org/forumdisplay.php?fid=1)
+--- Forum: General Discussion (https://forums.formtools.org/forumdisplay.php?fid=5)
+--- Thread: ReCaptcha not protecting forms (/showthread.php?tid=1396)
ReCaptcha not protecting forms - mahageekster - Jun 21st, 2011
Hi, I'm getting spam entries despite having ReCaptcha installed. Im mostly wondering if this is now a common problem (unlikely given the lack of forum posts on this problem).
The captcha seems to be operating correctly when tested.
I'm mostly just wondering if this problem is widespread, or is it just me? A solution (for me) is not critical, as the website will be upgraded to a CMS soonish.
Details:
FT version: 2.0.6
Generally I get 2-4 submissions per day - the submissions look very similar (some fields contain identicaal values). I wonder if its 'human' spam?
To my knowledge, this has been happening for some months, with frequency increasing in last few months.
The website (domain) in question is quite old, but does not generally get much traffic.
http://www.npa.com doty au/mailform.php
Thanks for any ideas.
RE: ReCaptcha not protecting forms - Ben - Jun 22nd, 2011
Hi Maha,
Huh! If you've tested that the reCAPTCHA is properly working, then there's not much else that it can do... there *are* actually ways to circumvent any anti-spamming technique, but to my knowledge it requires direct targetting by a hacker.
For example, if I were Evil, I could load your form on a porn site - or something that gets a lot of human traffic - then load your form page in an iframe, showing only the recapcha. The site would then promise them access to an area if they fill in the form. They fill it in, and the script does the rest: it fills the other fields with spam and submits the form with the captcha solved by a person. This is purely conjecture, but that would be one way to hack it.
I think I'll have to work on a new anti-spam module... integrating Akismet, for example, would be really handy (and besides, captchas are a total pain to the user).
One other possibility would be to use the Submission Pre-Parser module to add in one additional level of spam detection.
http://modules.formtools.org/submission_pre_parser/?page=spam_detection_example
Anyway, sorry I couldn't be more help...
- Ben