# Spambots abuse Mautic Forms

**URL:** <https://forum.mautic.org/t/spambots-abuse-mautic-forms/22316>\
**Category:** Product Support\
**Created:** [January 13, 2022, 8:04am UTC](https://forum.mautic.org/t/spambots-abuse-mautic-forms/22316 "2022-01-13T08:04:12Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![ekke](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/ekke/32/296_2.png) [@ekke](https://forum.mautic.org/u/ekke)\
**Post date:** [January 13, 2022, 9:46am UTC](https://forum.mautic.org/t/spambots-abuse-mautic-forms/22316/3 "2022-01-13T09:46:09Z")

</div>

We just discussed the topic in length in the DACH (DE/AT/CH) Meetup, recording is in #germany on Slack.  
Bottom lines:

- It’s a real problem (for Mautic as well as the rest of the world)

- It’s a tough problem

- “personalisation within this message” → needs to be sanitized!

- For that reason we should offer a solution in Mautic (e.g. a new form field type “Text without Link”, or at least a regex-based validation for “Text” fields). Ideally this would be a regular JS-based validation PLUS a server side removal of malicious things (Idea: This could be a form action! And in any case, it would have to run first, prior to e.g. “send email to contact”)

- If a submission fails due to validation, or if the entry is thrown entirely away server-side: fine!

- Else, Form Spam would still be bad, because it not only gives a bad impression for the recipients, but some will flag the Spam and that will destroy your rating at the email providers

- Thus the Captchas etc.:

- Honeypots or simple math tasks don’t help with serious attack tools (e.g. XRumer)

- Google ReCaptcha works pretty well (v3 is even user friendly) BUT it is not an option where GDPR has to be honored

- FriendlyCaptcha can cost money and is not 100% as good, but may well be good enough. And is GDPR compliant

- In Mautic, we should offer an easy way to use either solution with a form

- Other means include low-level thiings like IP-based denial of entire countries, fail2ban, … (only where applicable, of course)

---

_[View the full topic](https://forum.mautic.org/t/spambots-abuse-mautic-forms/22316)._
