I ALREADY had reCaptcha enabled in civi and on my Profile type, but it seems that spam bots were still making submissions to civiCRM and creating contacts (and got assigned to a group).

I only recently caught it because I turned on role synching between civi and drupal and saw spam accounts popping up assigned a role other than "authenticated".

After going back through the particular group in question (in civi), I noticed that there were contacts that had civi IDs but not Drupal (I'm assuming submissions before I turned on role syncing. I didn't load sample data when I installed civi)

I'm not even sure what the URL would be for the form where bots could create a contact record...


If you have a CiviCRM profile assigned to "Drupal User Registration" (as "Name and Address" is by default, I believe), then spam bots that apply for an account on Drupal will also be inserting fields from that profile into their associated CiviCRM contacts.

If you aren't using the account functionality you can turn it off in Drupal (admin/config/people/accounts) by allowing Admin only account creation. Otherwise you can look into Drupal-specific spam blocking modules such as Honeypot.

There are also some CiviCRM-specific fraud prevention suggestions that may be of interest to you.

  • These submissions were definitely made through a civi form since they had no corresponding Drupal account. – Ashe Higgs Jul 10 '15 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.