Answered Still a lot of spam, despite Honeypot, Rampart, recaptchav2, etc.

A lot of (Russian) spam came through my contact forms, so I installed recaptchav2 and Rampart (Honeypot). But spam still keeps coming in. I can't say it's less.

Have spammer evolved and able to bypass recaptchav2 and Honeypot? Are there any other countermeasures I can take?

Google Recaptcha gave me this message:

We detected that your site is verifying reCAPTCHA passed solutions less than 50% of the time. This could indicate a problem with your integration with reCAPTCHA.

Just a heads up on Recaptcha - am no expert, but a quick search opens eyes

https://www.google.com/search?q=bypass+recaptcha+v2

I'm not sure if this is an answer . Does Recaptcha work or not?

I'm not a programmer, so I don't understand those Google results.

Very direct

As noted, it was just a "heads up", not an answer

If you read pages in those results you will get your answer whether it works or not, but if you cant be bothered, it works, but it can be worked around

If your not up for reading, maybe watching a video will help: https://www.youtube.com/results?search_query=bypass+recaptcha [ed. note: iusemodx last edited this post 7 years, 11 months ago.]

Its a never-ending challenge. Spam evolves, unfortunately.

There are some practical steps you can take. You can implement an additional check that can fool the spam bots.

For instance imagine three checkboxes, with instructions in an image about which one(s) to check. If the result is incorrect, then the form wouldn't fire or better yet would fire but would be discarded. An alternate success message could inform a potential real person that the form was not finally submitted.

There are many tactics that can help.

Quote from: iusemodx at Oct 27, 2018, 04:37 PM

Very direct

As noted, it was just a "heads up", not an answer

If you read pages in those results you will get your answer whether it works or not, but if you cant be bothered, it works, but it can be worked around

If your not up for reading, maybe watching a video will help: https://www.youtube.com/results?search_query=bypass+recaptcha

Reading or video: I know that recaptcha's can be bypassed (that's why I opened this post). What I'm looking for is a solution. And I'm not a programmer. Too bad MODX is deficit on this aspect, comparing to other platforms.

I...gave you a real solution. It works because the machines can't work out what they should do.

You could also put in a text space that is hidden, and if anything is entered in there (a real user wouldn't even see the space) the sending would fail. But I think that's already pretty common.

What about your google solution? What does it mean that your integration isn't good enough?

If you have no need for that geographic location (Russia) adding the country to blacklist blocking all access to the site from the region. That is sometimes heavy handed, but certainly stops the flood gates for further investigation. If you are using a hosting vendor and do not have any internal technical teams you can open a ticket to block the region via configuration. Secondly you can get an modx pro to take a look at how the form(s) are implemented to make an informed recommendation on how to best solve.

Cheers