On Drupal 8/9 we have webforms that have been getting 5-20 spam/bot emails per day with foreign languages (looks like it may be Rusian). We have Honeypot, reCaptcha 2/3, Antibot, and Cloudflare setup but these messages still come through. I was wondering if there is a way to detect non-English characters and block the submissions?

An example of the body content of one of the submissions:

Your Message Здесь собраны лучшие рассказы русских писателей. Дети обожают читать про приключения и веселые истории из жизни своих сверстников, а так же про забавных животных. Смешные диалоги, необычные сюжеты и яркие иллюстрации влюбляют в себя юных читателей с первых страниц.

  • 3
    I don't understand the downvotes on this question. Spam is annoying and we should all help each other fight it; this is a legitimate question. Jun 4, 2021 at 17:25

2 Answers 2


Drupal allows you to alter a form using the hook_form_alter() hook. I work primarily in D7, but it looks like the same approach I'd take in 7 would work in 8/9.

You want to create a custom module and use hook_form_alter() to alter the validation part of the form. You want to check that whatever field you want to test against doesn't contain the characters you're getting.

The following is pseudo code, but hopefully can get you started in the right direction.

 function mymodule_myform_form_alter(&$form, &$form_state, $form_id){
      $form['#validate'][] = 'mymodule_myform_check_foreign_chars_validate';       

// callback function
function mymodule_myform_check_foreign_chars_validate(&$form, &$form_state){
      $char = "Д";
      $mystring = $form_state['values']['textfieldnametocheck'];
      // Test if text contains the word, character, etc, that you do not want 
      if(strpos($mystring, $char) !== false){
      form_set_error('textfieldnametocheck', t('Certain characters not allowed.'));

The gist is you want to find out the $form_id of the form you want to alter. And, you want to add additional validation logic so that when the submit button is hit, your module applies that additional logic against the form validation process.

Above I'm testing for just one character, but you could create an array of characters to test against. It really doesn't matter what language it is, you just know the characters are not English or any language you're doing business in. You could add Chinese characters, Greek, etc should you get spam in other languages.


How can I find the form ID of a form?


  • Instead of testing for individual characters from each language, you can also do something like check if strlen($string) !== mb_strlen($string) (do we have multibyte characters?) One potential problem with this approach is that emoji are multibyte, so if you have legitimate users using emoji this will block them too. Jun 5, 2021 at 8:38

I got the answer from Reddit, for Drupal 8 webform you can create a conditional for the email handler and use a regex expression to check that the submission field (body) contains only English characters. The expression I used to enable the submission is:



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.