Short Version: I would like to block Webform submissions that contain strings e.g. mail.ru in the webform textarea field.

Recently I am seeing a lot of fake webform submissions. I am already using honeypot contrib module and I have added quite a number of IP addresses to the server firewall. However there is still some spam coming through. For now I don't want use Captcha. Luckily those spammers always using recurring pattern e.g. same domain name.

How I can automatically block submission that contain certain strings? Using the rules + webform_rules module and Regex doesn't allow me to choose the Webform email field as data selector. selected-webform:0 doesn't look valid. What's the right way to block webform spam?

{ "rules_blocking_fake_registration" : {
"LABEL" : "Blocking fake registration",
"PLUGIN" : "reaction rule",
"OWNER" : "rules",
"REQUIRES" : [ "rules", "webform_rules" ],
"ON" : { "webform_rules_submit" : [] },
"IF" : [
  { "node_is_of_type" : {
      "node" : [ "node" ],
      "type" : { "value" : { "contactform" : "contactform" } }
  { "text_matches" : {
      "text" : [ "selected-webform:0" ],
      "match" : "plusgmail.ru",
      "operation" : "regex"
"DO" : [
  { "block_ip" : [] },
  { "mail" : {
      "to" : "admin@address.com",
      "subject" : "[site:name]: Blocking user [data:e_mail-value]",
      "message" : "E-Mail Adresse: [data:e_mail-value]",
      "language" : [ "site:current-user:language" ]

I really appreciate any comments and help.


Part 1 - Getting access to Webform data

Below is something about using Webform data in Rules, which may help you to get this to work (assuming your question is about D7) ...

You have access to all labels and all values of any field of a webform, ie:

  • [data:MachineFieldName-title] contains the Label of a field with machine name MachineFieldName.
  • [data:MachineFieldName-value] contains the Value of a field with machine name MachineFieldName

So try to use similar tokens. For way more details on this, and a prototype rule about this, refer to the answer to "How to create a node from a Webform using rules?":

  • the 1st attempt relates to using "Entity has field" (which doesn't work for Webform)
  • the 2nd attempt explains what to do in case of Webform.

With the above in mind, and looking at something I see in your Rules Actions (not Rules Conditions ...), it seems that [data:e_mail-value] might be pretty close to what you're looking for (assuming it's the field with machine name e_mail that you want to validate via a Rules Condition, since you didn't mention the machine name of the Webform field to be validated).

Part 2 - Validating Webform data

Everything described in Part 1 is a good start, but not sufficient to achieve your goal (= validate what is contained "in the Webform textarea field", as in your question).

However, you can use a technique similar to what is described in my answer to "How to do a data comparison to submitted webform data when using the Rules module?". For short:

  • Add an extra Rules Action to Add a variable, with a value assigned to it equal to your [data:e_mail-value-raw].
  • Add whatever validation you want, probably also something like a text comparison to check if the newly added variable value contains mail.ru.

Be aware: as per the Rules Event you are using in the rule contained in your question, the Webform has been submitted (and I'm not aware of what seems like a more appropriate event like "Before submitting a Webform"). So therefor your existing Rules Action to block the IP address is a good start (together with the eMail to the admin). But know that the form is submitted already.

  • Yes, as you can see my question is related to D7. The machine name is correct [data:e_mail-value]. I followed your answer, Unfortunately I am unable to define [data:e_mail-value] as data selector. php evolution is required. Looks like there's additional custom code required?
    – howdytom
    Nov 20 '17 at 14:58
  • Thanks. Unfortunately I can’t share screenshots in the comments. Creating a new condition with > Text comparison > Data selector > [data:e_mail-value] and COMPARISON OPERATION regular expression fails with "Data selector [data:e_mail-value] for parameter text is invalid."
    – howdytom
    Nov 20 '17 at 16:25
  • Pierre: That sounds great. I am kind of surprised that no one really wants to get rid of webform spam. Various captcha contrib module are not a solution. I prefer using rules to customised the workflow. Basically rules ships with all tools that are necessary to auto block ips and to get a instant mail notification. I just the perfect swiss-knife.
    – howdytom
    Nov 20 '17 at 16:51
  • @howdytom I cannot agree more with what you wrote in your prior comment.. But guess what ... I think I solved your "puzzle" (and I must say "I" like my own, Rules based, solution). Merci for the challenge! Nov 20 '17 at 19:00
  • Thank you so much for sharing and your time! Based on your solution I was able to create multiple conditions which includes a kind of blacklist with Regex text comparison. Finally the spammer ip address is automatically blocked and I am getting a mail notification. Excellent! Unfortunately Webform Rules doesn’t provide Event „Before“ a webform has been submitted. So, the first spam message still gets through. It’s a pity. Custom code is still required though.
    – howdytom
    Nov 21 '17 at 16:46

Try Webform Validation module. It adds validation options for webforms. One of these extra options is "words blacklist", where you can specify the list of strings that should not appear in your field. The spammers will get validation error and will not be able to submit the form.

  • Kiril, thank you. This looks like pretty much what I was looking for. However I don’t want to show spammer a validation error. Next step, spammer simply try out various combination until the submission is valid. Thus, I would like to auto block them.
    – howdytom
    Nov 20 '17 at 15:03
  • Your are welcome. 1. This module lets you specify the error message, so you can avoid giving clues to the spammers. 2. They come to your site to put specific messages with specific links, so if you forbid these links they would have to give up. Nov 20 '17 at 19:42
  • And, of course, there's no D8 version... sigh Mar 20 '19 at 17:34

To Avoid spam words on Webform. Try this module (Drupal 8 & 9) https://www.drupal.org/project/webform_spam_words We can specify the spam keywords, field and error message. It's a simple and lightweight module

  • 1
    Thanks for sharing. It is worth noticing, that Pierre's solution goes one step further. I was looking for a way to automatically block spammers ip address based on specific keywords. I will take a look at webform_soam_words module.
    – howdytom
    Apr 22 '21 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.