Answered Still a lot of spam, despite Honeypot, Rampart, recaptchav2, etc.

If it's a simple contact form, try SPForm. It has a number of spam-protection options and is usually very good at blocking spam (especially with capture + the math option). Keep in mind that in some developing countries, they hire kids to manually fill in forms. Nothing it going to stop that short of blocking IP addresses.

Quote from: paulp at Nov 07, 2018, 09:19 AM

Are you using formit for your forms ? if so make sure you are calling the recaptcha2 befor email in the hooks

&hooks=`recaptchav2,email`

It looks like this is the solution! I set it up like this and my customer did not receive any spam since then. Hopefully it keeps working like this.

Thanks everyone for finding a solution.

Quote from: nuan88 at Oct 27, 2018, 05:09 PM

Its a never-ending challenge. Spam evolves, unfortunately.

There are some practical steps you can take. You can implement an additional check that can fool the spam bots.

For instance imagine three checkboxes, with instructions in an image about which one(s) to check. If the result is incorrect, then the form wouldn't fire or better yet would fire but would be discarded. An alternate success message could inform a potential real person that the form was not finally submitted.

There are many tactics that can help.

I'm sure there are. But that's a bit of a fragile and elaborate way to implement on many sites. Besides that, I'm not a backender (yes, MODX has frontenders using it as well). I'm always looking for 'official' ways, which I think is best practice as well.

I don't disagree, really. I am also not a backend developer and these kind of solutions are not simple.

But the problem is, as soon as a 'complete' solution is produced, the spam bots start evolving. Wordpress for example does have all that stuff just to install...but then its a constant fight anyway for their platform. WP as I think we all know has a lot of viruses and bots that target it as a big platform.

Let's not even get to the fact that once the bots start changing, then the 'complete' solution isn't complete anymore, and the devs have to go back and enhance it.

When you have a set solution the bots will figure it out. When 1000s of sites all do the same thing its not going to be pretty.

Glad you could found a good solution.

My opinion is: the solution lies in better documentation. Lots of instructions and tutorails of MODX functions and addons are not really elaborated. Often it's guessing, trying, visiting forums, etc.

Oh yes certainly.

By the way I came back to add that the best solution is something like google with an extra, custom layer of some sort. That would be near foolproof, unless of course someone targeted the site...sigh.

As I said it isn't that hard, just a form with a bit of styling to add the extra layer. The best I think is where it asks a simple question and the user should put the answer in.

Just to clarify on that ( and its got me a few times ), the hooks execute in order, so if you have email before validation it will send the email before it does the validation, if the validation then fails the email has still been sent.

Glad it looks to be sorted now though

Perhaps Bob or someone else with access could update the docs to just say the hooks need to be in order of execution ?

It was already there, but I tried to clarify it a little.

Quote from: BobRay at Nov 10, 2018, 12:06 PM

It was already there, but I tried to clarify it a little.

Thanks Bob

Quote from: paulp at Nov 10, 2018, 10:54 AM

Just to clarify on that ( and its got me a few times ), the hooks execute in order, so if you have email before validation it will send the email before it does the validation, if the validation then fails the email has still been sent.

Yes, I forgot about that as well. RecapctvjaV2 does give an example, but it does not state clearly that the order is important for execution.