Spam

  • studioblauw

    (@studioblauw)


    2 weeks, 1 day ago

    Hello,

    I am having a problem with spam submissions through Contact Form 7 on a client’s website.

    Website: https://www.hulsebosch.nl/

    We are receiving automated spam submissions through the Contact Form 7 form “Neem contact met me op”.

    I have already taken the following measures:

    – Google reCAPTCHA v3 is active and connected through Contact Form 7 → Integration.
    – Honeypot is enabled through the CF7 Apps Honeypot App.
    – The Honeypot field is actually included in the contact form:
    [honeypot honeypot-588]
    – The contact form is working correctly for legitimate visitors.

    However, spam submissions are still getting through.

    In Flamingo, this submission is shown as:

    • Status: “Not spam”
    • Submission result: mail_sent
    • It was submitted through the “Neem contact met me op” form.

    I expected reCAPTCHA v3 and the Honeypot to detect this type of automated submission, but apparently they do not.

    Could you please advise:

    1. Why might reCAPTCHA v3 be allowing these submissions through?
    2. Is there a way to see the reCAPTCHA v3 score for an individual submission in Flamingo?
    3. Is there a recommended way to increase the reCAPTCHA spam protection without blocking legitimate visitors?
    4. Are there any additional Contact Form 7 settings you recommend for this situation?

    I would appreciate any advice on how to diagnose this properly before changing the reCAPTCHA threshold or adding additional plugins.

    Thank you!

    The page I need help with: [log in to see the link]

Viewing 4 replies - 1 through 4 (of 4 total)
  • heurilens

    (@heurilens)

    2 weeks ago

    Hi,

    I had this exact problem on a client’s CF7 form — reCAPTCHA v3 and Honeypot both “on”, spam still landing in Flamingo as “Not spam / mail_sent”. Two things I learned the hard way:

    reCAPTCHA v3 doesn’t block anything by itself, it just scores (0–1) and CF7 only rejects below 0.5. The spam hitting us now comes from real headless browsers on rotating IPs, so it scores high (0.7–0.9) and sails right through — and Honeypot only catches bots dumb enough to fill hidden fields. If you add a snippet to log the v3 score into Flamingo, you’ll probably see the same thing, which means raising the threshold just starts blocking real people before it stops the spam.

    What actually fixed it for me was routing the CF7 notification email through https://humainbox.com you literally just swap the recipient email in the form’s Mail tab for the address it gives you, no plugin. It reads the message content and holds the AI-generated junk instead of the “is this a bot” guessing game. It fails open (if anything breaks, the message still gets delivered, so you never lose a real enquiry), and it has a dry-run week where everything still comes through but it shows you what it would have held — so you can check it against your real traffic before trusting it. Free tier covers a single form.

    Been running it for a while now and the inbox is finally quiet. Worth a look before you start tweaking thresholds.

    Plugin Author Takayuki Miyoshi

    (@takayukister)

    2 weeks ago

    Where on the site do you have the form having the issue?

    Thread Starter studioblauw

    (@studioblauw)

    2 weeks ago

    https://www.hulsebosch.nl/neem-contact-met-me-op/

    Plugin Author Takayuki Miyoshi

    (@takayukister)

    2 weeks ago

    What other plugins and theme do you use on the site?

Viewing 4 replies - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.