Use Case: Reducing Form Bot Submissions

Description

You want to reduce the number of recurring bot submissions to your Sugar Market form or external lead form.

Steps to Complete

The following are just a few methods you can use to help identify and prevent form bot submissions: 

Add reCaptcha

• If you are using a Sugar Market Form, enable the reCaptcha component in the build step.
• If you are running an external lead form, then ask your web designer to implement a reCaptcha on your page.

Change the Form Code

Sometimes bot submissions obtain access to your form and will constantly submit submissions no matter what is done. By creating a brand new form or republishing the form, the attackers will not have access to the new code initially. 

Change the Form Location

Similar to the previous recommendation, if your form is on your website, then changing the URL to a new URL could throw the bots off from the spam results. Example: If your form is hosted on www.mywebsite.com/contact-us then try changing the form location to www.mywebsite.com/contact-us-2.

Apply a Double Opt-in Strategy

While this will not prevent bot submissions, it is not only a good practice, but those who complete a double opt in are most likely a human submission.

Use a Hidden Field

A honeypot is a hidden field on the form that has a blank value by default. Since it is hidden, an actual user will fill out the form without ever noticing the hidden field and thus the user's form submission will contain a blank value for the honeypot. A spam bot, however, attempts to insert field values in every single field they are able to locate. This also includes the honeypot hidden field. While this method does not necessarily prevent spam bots from filling out your form, the honeypot offers a good way to determine if a form submission is from a spam bot. 

Note: The honeypot option is only viable with legacy pages or external forms since a value is required in Form Builder hidden fields.

Form Validation (non-Sugar Market forms)

In addition to the honeypot technique, or in lieu of if you are using an external form connector to pass the data to Sugar Market, having a web developer add some type of validation upon submission can prevent bots from being captured and sent to Sugar Market. There are a variety of ways to do this and the code can be simple or more complex. An internet search can provide more examples if it is something you want to explore further. While Sugar Market forms are limited in preventing bot submissions, this method has proven to work for our clients.

Other methods for reducing form bot submissions include looking for legitimate email address syntax, only accepting submissions from current regions, and preventing multiple submissions from the same IP address or sessions.