We have a website developed using drupal commerce.All listing and details pages of products are custom made ones.Not drupal views.We have a issue with fake orders.We are getting nearly 1000 fake orders from this site.Doing nothing but only adding products to the cart.I can see that its from whole website.

We have used a hyperlink as add to cart button.Is there any problem with this?

This site is open for anonymous users.When we restrict the site only for registered users these fake orders dramatically reduce.I meant 0 fake orders.

Cant guess whats going on with this.Have installed some spam prevention drupal modules but no luck.

Any one suggest a method to prevent this.


  • Hello and welcome. Please make your title more substantial, now it's hard to tell if you want to place them for test purposes, or to get rid of them. And how do you know orders are fake? Who can place order? Anyone out of the street, it seems? If so, what countermeasures you take to verify guys who tries to order? CAPTCHA? Mail confirmation? I'm afraid it may be more of a design error or UX issue than purely Drupal one. – Mołot Sep 11 '13 at 6:39
  • Hi Molot, Thanks for pointing about the subject and your answer.As I can the Google analytics less than 50 visits per day for this site.So I am wondering how come there can be this much of orders.Anonymous can place orders without register to the site.We are using mail confirmation to verify the orders. – global Sep 11 '13 at 7:04

Your problem is due to robots, in particular spam robots (spambots). I've monitored these pests closely on my site for some time, and found that spambots (such as XRumer) will click on anything that's clickable. I doubt that you need to be concerned about spammers of the human kind.

There is nothing wrong with the suggestions from Strae, but don't expect spambots such as Xrumer to respect tags such as rel="nofollow". (Nice robots such as googlebot do, so if your fake orders are from nice robots only, this will fix it.).

In my experience, the single most successful measure to filter out spambots is to add effective CAPTCHA to the site. If the user is not logged in yet, the CAPTCHA must be present in the order submit form. If a new user register, the CAPTCHA must be present in the registration form. (You don't need to use CAPTCHAs in the order submit form for logged in users). If you set up a CAPTCHA, don't bother with "math challenge", "leave this field blank" and "ReCAPTCHA" - XRumer knows how to solve those.

On my site, the Captcha Riddler is by far the most successful robot guard. Even blatantly obvious "riddles", such as: "What is Justin Bieber's first name?" stops the spambots.

PS: If your site is big enough, your "riddles" and their answers will probably be added to the knowledge base of XRumer and other spambots. But if you run a small site you will probably be able to fly under the radar for a long time with "riddles" you create yourself (and you just watch the logs and retire and replace any "riddle" that is cracked by a spambot).

  • Personally I wont put a captcha in every add to cart form, but i'll prefer the user must sign in before solution: only 1 captcha in the registration page, and you're done. Having the captcha in every product page looks insane to me ;) – Strae Sep 11 '13 at 13:23

We have used a hyperlink as add to cart button.Is there any problem with this?


Links feeds crawlers and spammers: while the first one only follow the links, so you could try adding rel="nofollow" to your links, spammers will also submit forms (even if I never seen spammers using the add to cart forms, is possible)

As you noticed, make the user register and login can be one solution, if you can't do that, i'll do the steps above:

  1. add rel="nofollow" to your links
  2. if point 1 doesnt work, remove the links and find another way (forms, or divs triggered via javascript)
  3. if point 2 fails too, make your users sign up.

Tip: is normal to have orders that remain in the cart for long time: if the user doesnt sign up, the session will expire soon or later and if he come back to buy after, let's say, 1 week, probably Drupal will create another cart/order.

We have a maintenance cron that delete all the cart order of anonymous users older than 1 month; even if this doesnt solve the problem, maybe is a little help ;)

** UPDATE **

Yesterday I got a situation like yours, where the add to cart must be a link and not a form (really big list of items). To prevent fake orders (I remembered your situation), i wrote a small module where if the user is logged in, the item get added to the cart, oterwise the user get redirected to the item's page (where I can then use captcha, honeypots, whaterver)

Hope it can helps.

  • Hi Strae, We have added the rel="nofollow" to the link and will see if there any difference. Otherwise as you mentioned will us ea JavaScript method We have used a drupal module call cart Expiration and it cleans all these cart orders. Thanks for you reply – global Sep 11 '13 at 7:54
  • The rel="nofollow" should tell the crawler to not follow that link, but then is up to the crawler itself to follow or not.. and spammers surely will ignore it... just try and see if get better ;) – Strae Sep 11 '13 at 9:28
  • I have added the rel="nofolow" its about 2 hours now.Still I cannot see any spam orders.Before add this I had at least 3/4 fake orders – global Sep 11 '13 at 10:08
  • nice to hear that ;) Read also @gisle-hannemyr answer, is much more detailed (and well-written) than mine ;) – Strae Sep 11 '13 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.