How to stop spam email coming through my web form?

[tdrsam]

I have a web form that keeps getting submission from what I'm guessing is a spambot. None of the data I'm getting in the emails matches the form on the website, not even the subject line which is a hidden input. I can't figure out how to stop them. I tried using recaptcha but couldn't make it work (kinda hate it anyway), I also tried using a honeypot trap and a couple of javascript scripts but nothing stops the emails.

This is the form:

<form name="form1" id= "form1" method="post" action="formmail.php" onsubmit="return trappetyTrap();" enctype="multipart/form-data">

      <input type="hidden" name="recipients" value="me@email">

      <input type="hidden" name="good_url" value="http://whatever/good_page.php">
      <input type="hidden" name="bad_url" value="http://whatever/bad_page.php">

      <input type="hidden" name="subject" value="Sent from website">

      <label for="person">Your Name : </label>
      <input type="text" name="person" id="person" size="39">

      <label for="email">Email : </label>
      <input type="text" name="email" id="email" size="39">

      <label for="company">Company Name (if applicable):</label>
      <input type="text" name="company" id="company" size="39">

      <label for="phone">Contact Phone :</label>
      <input type="text" name="phone" id="phone" size="39">
      
      <!-- THIS IS TO KEEP THE B.O.T.S. AWAY-->
      <!-- IT USES THE JS AT THE BOTTOM OF THE DOCUMENT TO STOP SUBMISSIONS -->
      <!-- FROM ANYTHING WITH THIS FIELD FILLED IN -->
      <label for="ruse" id="ruse_label">Keep this field blank</label>
	<input type="text" name="ruse" id="ruse" class="ruse" />
	<!-- END B.O.T. TRAP -->

      <label for="message">Talk to us:</label>
      <textarea name="message" id="message" rows="10" cols="47"></textarea>
      
           
	<button type="submit" class="submit">Submit</button>
 </form>

I changed some of the data in there, like the email address and the url, to protect my clients anonymity. This is the script for the honeypot trap.

function trappetyTrap() {
    	// This is only here because jslint told me to put it here
    	"use strict";
	// The field is empty, submit the form.
    	if (!document.getElementById("ruse").value) {
        	return true;
        // If an 'author' input exists - it's a spam bot
        } else if (document.getElementsByName("author")) {
        return false;	
    	} else {
	// the field has a value it's a spam bot
        	return false;
    }
}

As you can see, I'm using a hidden field to trap the bots and I'm trying to pick out a field called author and block any submissions that contains it. You might be thinking there's no input with that name and you'd be right. I think it was part of an old form that was deleted a while ago. This is the data I'm receiving from the emails.

From: <pberman@srafoods.com>
 Date: 7 Dec. 2017 3:50 am
 Subject: Imaginary Worlds Submission
 To: <me@email>
 Cc: 

email: pberman@srafoods.com
realname:
author:
phone:
storyTitle:
storyFile:

This is an alternate version of the js. It tries to use the subject line of the email to block the spambot.

 // Get the value of the subject line of the email - add to variable
	var iws = document.getElementsByName("subject").value;
	// start function
	function trappetyTrap() {
    	// This is only here because jslint told me to put it here
    	"use strict";
	// The field is empty, submit the form.
    	if (!document.getElementById("ruse").value) {
        	return true;
    //} else if (iws === "Imaginary Worlds Submission") {	
        return false;
    	} else {
	// the field has a value it's a spam bot
        	return false;
    }
}

None of this works. What can I do?

[NoraJHolman]

There are few things you can do,

Test their patience with powerful form field validation
Nuke 'em with the big one - CAPTCHA
Use data confirmation screen

You may also try addons like Web-form-buddy.

[tdrsam]

Okay. Thanks. I tried the form field validation which didn't work. I'm now trying the data confirmation screen and we'll see how it goes. I'm also thinking the php script might be the hackers target rather than the web form, so I've got another idea there. Thanks again.

[gits]

well - to be honest - how could you be sure that it happens through your site. the easiest way for the spammer would be to just use your form-action as a target for a local script that submits whatever to it. he can look up what your fieldnames are - thus knowing what key/values your php script expects. so the only safe validation would be at the serverside - where you should check the content, headers like the origin header for example and such. you have a public entrypoint - which is the purpose of your form of course - thus you cant really avoid that data is sent to it because of its nature. using a local copy of your form and changing it locally will allow to send whatever the attacker wants to this entrypoint. So just validate at the server.

[Seneltali]

Well...I have this problem and I really don't know what and why is happening. If someone knows how to stop spam email coming through my web form please help me. I also have some friend who have the same problem with spam email and they found a solution for a short period and again started those spam emails. One of them told me once that email deliverability is the ability to deliver emails to subscribers’ inboxes and some specialists use to gauge the likelihood of their email campaigns reaching their subscribers’ inboxes related to actual delivery–like ISPs, throttling, bounces, spam issues, and bulking.