In the morning you open your mailbox: twenty new requests from the site. Eighteen offer “promoting to the TOP”, lead to obscure sites or consist of random letters. Two real ones are easy to lose in the garbage.
Below is how to distinguish spam from bots, who is sending it and why, and what protections work without annoying live visitors.
- Contents
- How to understand what bots are writing
- Who is spamming and why
- What Spam Does Not Do
- Six ways to protect
- What should not be done
- Which one to choose
How to understand what bots are writing
- In packages, at any timeSeveral requests per minute, sometimes in the middle of the night when live customers are asleep.
- Links and nonsenseIn the fields - website addresses, text in another language or character set.
- False contactsName from random letters, phone not in format, mail type
qx81zt@…. - One text for allSame messages in different requests, link even in the "Name" field.
Who is spamming and why
- Spamer programsThey browse websites themselves, find forms and send ads into them. They don’t care who reads the application: the goal is to send as many as possible. Sometimes a bot just checks to see if the form sends an email, and then sends spam through it.
- People for little moneyManual spam: a person inserts text into forms for a fee. It is more difficult to cut off automatically, but its volume is many times smaller.
What is the harm of spam, other than irritation
- The actual applications are lostWhen there is a lot of garbage, live requests are skipped or answered late — the client has already written to another by then.
- Mail domain suffersIf the form sends a copy of the letter to the address from the application, it is used to send spam to strangers. Then even ordinary emails from your domain begin to go to "Spam".
- The load is increasingSending a form is one of the heaviest operations for a website: database entry, email, notification. Hundreds of shipments per hour are noticeable.
- Analytical breaks downIf submitting forms is the goal in Metrics, spam turns request statistics into noise, and advertising starts to be tailored to false figures.
Six ways to protect — from simple to reliable
The lower in the table, the more bots cut the way. Usually a combination of two or three is enough.
| Method | Which cuts off | Visible to the client |
|---|---|---|
| Trap field | Simple bots | No |
| Time test | Bots that send the form instantly | No |
| Frequency limitation | "Bags" of requests from one address | No |
| Verification of contents | Links, stop-words, manual spam | Rarely — if the application has been marked incorrectly |
| capcha | Most of the bots | Yes, some people are leaving |
| Filter to site | Bots at once on all forms | No |
- Hidden field-trapIn the form add a field that a person does not see. The visitor does not fill it, but the bot fills everything in a row - such a request is rejected. Against simple bots works well and completely unnoticed.
- Checking the filling timeA person needs at least a few seconds to enter a name and phone number. The bot sends the form within a fraction of a second of the page loading – too fast submissions are discarded.
- Frequency limitationYou cannot send ten requests per minute from a single address. From bots, which come from thousands of addresses, this does not save, but "packs" removes.
- Verification of contentsRequests with links, stop words, or text in unexpected language are flagged as suspicious. Against manual spam this is almost the only automated way. It is better to mark it than to delete it: this way the actual request with the link to the client's site will not be lost.
- capchaIt works, but it comes at a price: some customers will not be able to figure out the pictures and will leave. If you still need a captcha, choose "invisible" - it shows the task only to suspicious visitors. Such a mode exists, for example, in Yandex SmartCaptcha.
- Filter to siteThe most reliable level. Site protection recognizes programs by technical characteristics and behavior, and when flooded includes a browser check - the live visitor does not notice it. A bot that does not reach the site will not send the form.
- The botis looking for forms on websites
- Site Protectionrecognizes the program and blocks it
- The application form receives only people's applications
Filtering to site: the bot is filtered before it sees the form.
What should not be done
- Remove the form and leave only the phone. Some customers don’t like to call – they will leave with the spam.
- Add required fields. Bots don't care how many fields to fill in, but humans don't.
- Put a complex captcha on the entire site. Spam will be less, but so will requests from people.
Which one to choose
| Situation | It helps |
|---|---|
| Spam a little, it's simple | Field-trap and time test Usually this is a form customization, not a new site. |
| Spam is many, forms several | Site-to-site filtering: it protects all forms at once and reduces load at the same time. |
| Manual spam | Content filters and marking suspicious requests instead of removing them. |
| The site is old, and it is time to redo it anyway | A platform where security is part of the core, not a set of separate add-ons. |
Before any configuration, send the form yourself - from your phone and from your computer - and make sure that the request is received. After setting up, check again: the security should not cut off people.
Secure all forms at onceWhiteShield is placed before the site on your server: it blocks bots by technical features and behavior, and when flooded, it activates a browser check that the live visitor does not notice. I take care of setting up and updating the protection.Read more about WhiteShield