Reject Form Submissions with URL in them

Question

I have a client who is using Drupal and has an email contact form. The problem is they are getting spam sent through the form daily.

I have tried the Re-captcha plugin, captcha plugin, Anti-spam (Askimat), and Honeypot plugins.

The offenders are using programs like XRumer which is capable of solving captcha's and none of these plugins have been able to stop the bots.

So I am asking others if they have any advice on how to stop these contact form spam submissions?

Since this particular form shouldn't have a legitimate reason for a URL in the body section, possibly I could detect URL's and then return an error if they are present when a form is submitted?

Answer 1

It is possible to create contact forms using either the Webform module, or the Entityforms module.

The beauty of the latter is the ability to attach fields, and to validate those fields with the Field Validation module, which offers a wide range of validation options.

There is a Webform Validation module for use with Webforms, but I think you will find Entityforms with Field validation to be a little more flexible and, perhaps, easier to use.

Either one should let you scan text for say "<a href=" or any other undesireable word or phrase (blacklist matching) or constructs using regular expressions, if you are so inclined.

Answer 2

I am not familiar with what XRumer can and can't do, but it would surprise me if it had the answer to all possible questions. That in mind I would suggest Captcha Riddler which I find works great.

Answer 3

A very simple alternative with custom code (I personally think installing a bunch of modules for such a simple task is massive overkill):

function MYMODULE_form_alter(&$form, &$form_state, $form_id) {
   if ($form_id == 'my_form_id') {
     $form['#validate'][] = 'MYMODULE_form_link_removal_validation';
   }
}

function MYMODULE_form_link_removal_validation($form, &$form_state) {
  // Basic regex for anchor tags
  $regex = '/<a[^>]*>/i';

  if (preg_match($regex, $form_state['values']['body_field'])) {
    form_set_error('body', t('Links are not allowed in this field.'));
  }
}

You could take that a bit further if you wanted and implement a proper filter for it (see hook_filter_info()), and also attempt to match links outside of anchors if you have the 'Convert URLs to links' filter turned on. The mechanism is the same, the string matching method would just need to be replaced accordingly.

Answer 4

Not too sure about checking for a URL but there is a page on drupal.org that talks about spam prevention on the contact form - Spam Prevention. It mentions a few modules that you haven't tried yet.

There is also a slew of spam prevention modules on the following drupal.org page - spam prevention drupal wiki page

Answer 5

Here is the full module code(D6) which blocks url submissions within Webforms. If you want D7 version then please let me know.

Even if you block url submissions, Bots would still try to post! I've one D6 based site and all spammers from around the world try to spam it whatever way, with or without url.