I have a client who is using Drupal and has an email contact form. The problem is they are getting spam sent through the form daily.

I have tried the Re-captcha plugin, captcha plugin, Anti-spam (Askimat), and Honeypot plugins.

The offenders are using programs like XRumer which is capable of solving captcha's and none of these plugins have been able to stop the bots.

So I am asking others if they have any advice on how to stop these contact form spam submissions?

Since this particular form shouldn't have a legitimate reason for a URL in the body section, possibly I could detect URL's and then return an error if they are present when a form is submitted?

  • Mollom might be a better solution than. it goes beyond catpcha protection with filtering methods. Mar 10, 2013 at 1:20
  • I once wrote a custom Rule that checked comments for certain keywords using a long regex (something like \b(?:purses|dental|headphones)\b) because I was getting a lot of spam for certain types of products. It worked pretty well… Rules could conditionally approve or reject the comments depending on whether or not the comment body passed my regex. Ultimately, as the level of spam escalated, I just changed the Rule to delete the offending comments without bothering to check them manually :-p
    – thirdender
    Mar 12, 2013 at 18:58

5 Answers 5


It is possible to create contact forms using either the Webform module, or the Entityforms module.

The beauty of the latter is the ability to attach fields, and to validate those fields with the Field Validation module, which offers a wide range of validation options.

There is a Webform Validation module for use with Webforms, but I think you will find Entityforms with Field validation to be a little more flexible and, perhaps, easier to use.

Either one should let you scan text for say "<a href=" or any other undesireable word or phrase (blacklist matching) or constructs using regular expressions, if you are so inclined.


I am not familiar with what XRumer can and can't do, but it would surprise me if it had the answer to all possible questions. That in mind I would suggest Captcha Riddler which I find works great.


A very simple alternative with custom code (I personally think installing a bunch of modules for such a simple task is massive overkill):

function MYMODULE_form_alter(&$form, &$form_state, $form_id) {
   if ($form_id == 'my_form_id') {
     $form['#validate'][] = 'MYMODULE_form_link_removal_validation';

function MYMODULE_form_link_removal_validation($form, &$form_state) {
  // Basic regex for anchor tags
  $regex = '/<a[^>]*>/i';

  if (preg_match($regex, $form_state['values']['body_field'])) {
    form_set_error('body', t('Links are not allowed in this field.'));

You could take that a bit further if you wanted and implement a proper filter for it (see hook_filter_info()), and also attempt to match links outside of anchors if you have the 'Convert URLs to links' filter turned on. The mechanism is the same, the string matching method would just need to be replaced accordingly.


Not too sure about checking for a URL but there is a page on drupal.org that talks about spam prevention on the contact form - Spam Prevention. It mentions a few modules that you haven't tried yet.

There is also a slew of spam prevention modules on the following drupal.org page - spam prevention drupal wiki page


Here is the full module code(D6) which blocks url submissions within Webforms. If you want D7 version then please let me know.

Even if you block url submissions, Bots would still try to post! I've one D6 based site and all spammers from around the world try to spam it whatever way, with or without url.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.