I ALREADY had reCaptcha enabled in Civi and on my Profile type, but it seems that spam bots were still making submissions to CiviCRM and creating contacts (and got assigned to a group).

I only recently caught it because I turned on role synching between civi and drupal and saw spam accounts popping up assigned a role other than "authenticated".

After going back through the particular group in question (in civi), I noticed that there were contacts that had Civi IDs but not Drupal (I'm assuming submissions before I turned on role syncing. I didn't load sample data when I installed civi)

I'm not even sure what the URL would be for the form where bots could create a contact record...

1 Answer 1


If you have a CiviCRM profile assigned to "Drupal User Registration" (as "Name and Address" is by default, I believe), then spam bots that apply for an account on Drupal will also be inserting fields from that profile into their associated CiviCRM contacts.

If you aren't using the account functionality you can turn it off in Drupal (admin/config/people/accounts) by allowing Admin only account creation. Otherwise you can look into Drupal-specific spam blocking modules such as Honeypot.

There are also some CiviCRM-specific fraud prevention suggestions that may be of interest to you.

Update: a recent extension that relates is Form Protection, which "Provides various ways of protecting forms from spam/bots including Honeypot, Flood control, ReCAPTCHA v2 and v3."

  • These submissions were definitely made through a civi form since they had no corresponding Drupal account.
    – Ashe Higgs
    Commented Jul 10, 2015 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.