I'm dealing with a frustrating spam problem on my client's WordPress site where we use GravityForms. Despite having several anti-spam measures in place—like Akismet, reCAPTCHA, and GravityForms Zero Spam—spam submissions keep slipping through. The spammer seems to know what they're doing, continuously changing their IP address and targeting the site with the same name, phone number, email, and address variations. So far, I've recorded eight spam entries this month, all from different IPs primarily located in New York, Ohio, and Colorado. Although I've activated "No Duplicates" for email and project descriptions, it hasn't helped. I just enabled it for phone numbers too. Blocking IPs seems futile given how frequently they change. I also noticed through GA4 that the spammer is coming via Google search ads, causing extra expenses for my client. I'm open to any suggestions or techniques to better tackle this issue!
3 Answers
It sounds like you’re facing targeted manual submissions, which can be tough for standard anti-spam solutions. If you can pinpoint specific keywords commonly used by the spammer, consider creating a custom plugin to block any submissions containing those terms. Here's a simple setup: create a file called 'form-submission-blocker.php' in the wp-content/plugins directory and use the provided code to ban specific keywords. This will stop any form submissions that match those keywords from going through. Just make sure to customize the keyword list as needed!
You might want to try using OOPSpam; I've found it works really well for similar issues! It’s worth a shot to see if it can help reduce the influx of unwanted submissions.
I’ve been through the same nightmare with Gravity Forms. What really worked for me was integrating reCAPTCHA and turning on the "Honeypot" feature that’s built into Gravity Forms. The Honeypot adds a hidden field that bots usually fill out, helping to trap them. While it’s not foolproof, it definitely reduced the spam I was getting. Also, I found keeping track of submissions through notifications helped spot spam patterns more easily. Hopefully, this combo can help you too!
As I stated in the original post, I’ve got Akismet and reCaptcha installed already. I’m pretty sure this is not a bot issue.
Awesome! Thank you so much for the detailed steps, I’ll try that!