Spambot creates 4000 orders a day

Question

Our webshop (built in Drupal 7 and Drupal Commerce) gets bullied by a SPAMBOT which creates about 4000 orders a day. These orders are getting registered as created by 'Anonymous' (unchecked) and stay stuck in the 'Shopping Cart' Apparently, the Spambot creates these orders by adding a product to the shopping cart on the product overview page (a custom built view with all products and for every product item an Add to cart button). Under each 'Add to cart' button, there's a hyperlink. We've already attributed a 'NOFOLLOW' link to those hyperlinks, but the issue still persists.

Our initial set-up for the 'add to cart' button for each product on the Product Overview Page was that people could instantly add a product to the shopping cart without first having to visit the product page. On the other hand, we chose to offer customers the opportunity to pay as a guest. This, as well, to rule out as many stumbling blocks as possible during the ordering process, which may discourage customers.

Does anyone have a possible solution, preferably a solution that does not compromise the user experience (or has as little impact as possible on the UX?).

Answer 1

Blocking is hard. Honeypot is a good deterrent, but if you allow anonymous users to click links that add products, then having spam orders might be your new reality. Removing useless, old carts is easy.

We use Commerce Cart Expiration on a number of stores. Also, sometimes its preferable to delete orders outright based on some criteria. For that, you can use Commerce Order Cleanup utility module.

Answer 2

First off you should block the IP off the spam bot to stop all the orders coming through. This can be done in standard Drupal interface in D7.

Then install some or all of these modules. https://www.drupal.org/project/recaptcha is very good and may solve your problems. This is by Google and blocks known threats from your site, which probably include your daily visitor.

In the past I have had great results from using the Botcha module. This also uses a honeypot field to trick the spam bots. This will solve your UX issues as it works in the background and will reduce your spam considerably.

Maybe later, if you are going to create user accounts to your store, verify the users email using a verify, for example with the Email Verify module.