Is this a valid antispam strategy?

  • tapulator

    (@tapulator)


    1 week, 3 days ago

    Hi guys,

    I work for a non-profit. We receive quite a lot spam via our CF7 forms, recently.

    The story so far:

    As German organization our data privacy officer wasn’t okay with any antispam integration CF7 offers. So, I searched for data privacy friendly solutions. The honeypot method seems to be a good choice. I picked WP Armour for a test.

    Honestly, I’m not happy with WP Armour’s integration of CF7. After reviewing the code the spam protection basically boils down to excluding clients without JS enabled.

    The basic idea:

    Why not ditch WP Armour and just provide CF7 forms to JS-enabled clients? Turns out this is not easy to do.

    I would have to “cache” the generated form somewhere. Then I would have to load the cached form via JS, obviously. The first part is the difficult one.

    • How do I extract the generated form?
    • How do I provide the generated form for loading via JS without exposing it to spammers?
    • And would this “lazyloaded” CF7 form work in the first place?

    I’m pretty unsure if this is a good idea, so I’m asking for your feedback.

    And generally asking:

    Do spambots have to use the actual form? If the endpoint accepts requests from anywhere, frontend-only protection would be useless.

    Looking forward for your insights!

    • This topic was modified 1 week, 3 days ago by tapulator.
Viewing 5 replies - 1 through 5 (of 5 total)
  • Thread Starter tapulator

    (@tapulator)

    1 week, 3 days ago

    If the endpoint accepts requests from anywhere, frontend-only protection would be useless.

    Well, looks like you can post form data from anywhere using CF7’s REST API. As long as you know _wpcf7_unit_tag , which shouldn’t be too hard to obtain, you can fire away.

    That could explain receiving spam literally every second from time to time.

    Hm, I’m afraid restricting the form to JS-users only won’t reduce spam significantly. Or is it rather unlikely that a spammer takes the effort to crawl the unit tag?

    Plugin Author Takayuki Miyoshi

    (@takayukister)

    1 week, 3 days ago

    How did you conclude that the spam protection measures Contact Form 7 provides are not acceptable to data privacy authorities, and that a honeypot can be an alternative solution?

    Thread Starter tapulator

    (@tapulator)

    1 week, 2 days ago

    Thanks for your reply (and providing this great plugin), @takayukister! 🙂

    To be clear: I don’t assess data privacy compliance nor evaluate it. That’s not my responsability in our organization.

    Our data privacy officer doesn’t want any US-parties involved, since it’s currently highly unclear if the US will honor its data privacy agreements with the EU in the near future.

    Honeypots seem perfect considering data privacy because they simply don’t use/rely on user data. Though they are far from being a perfect antispam tool because of the aforementioned characteristic.

    I don’t know how severe the (theoratical) hit on efficiacy would be in our case.

    Just fishing for some feedback/recommendations here. I’m a seasoned developer but spam has never been a real problem for me, so I don’t have much experience involving antispam under my belt.

    Plugin Author Takayuki Miyoshi

    (@takayukister)

    1 week, 2 days ago

    I always recommend a combination of Akismet and Turnstile. They are US-parties and trustworthy. I don’t think it’s rational to avoid all US parties when it comes to security.

    Honeypots are not even a spam protection. I never recommend it.

    Thread Starter tapulator

    (@tapulator)

    1 week, 2 days ago

    Yeah, I’m not a big fan of this whole avoid US tech agenda either. Seems very unlikely to me that US companies will ignore the data privacy needs of their EU customers. But that’s not for me to decide.

    Actually, the first thing I did was reading your blog post about the antispam integrations CF7 offers. After that I recommended Turnstile and Recaptcha as second option. Well, you know the result. (:

    But why do you consider Honeypots not as spam protection at all? Are they mostly ineffective because spambots are JS-enabled or smart enough to circumvent them these days?

Viewing 5 replies - 1 through 5 (of 5 total)

You must be logged in to reply to this topic.