Answers.Body: <p>If you have a CiviCRM profile assigned to &quot;Drupal User Registration&quot; (as &quot;Name and Address&quot; is by default, I believe), then spam bots that apply for an account on Drupal will also be inserting fields from that profile into their associated CiviCRM contacts.</p>
  <p>If you aren't using the account functionality you can turn it off in Drupal (<strong>admin/config/people/accounts</strong>) by allowing <em>Admin only</em> account creation. Otherwise you can look into Drupal-specific spam blocking modules such as <a href="https://www.drupal.org/project/honeypot" rel="nofollow noreferrer">Honeypot</a>.</p>
  <p>There are also <a href="https://civicrm.stackexchange.com/questions/2345/how-to-prevent-fraud-attempts-on-contribution-pages">some CiviCRM-specific fraud prevention suggestions</a> that may be of interest to you.</p>
  <p><strong>Update:</strong> a recent extension that relates is <a href="https://civicrm.org/extensions/form-protection" rel="nofollow noreferrer">Form Protection</a>, which &quot;Provides various ways of protecting forms from spam/bots including Honeypot, Flood control, ReCAPTCHA v2 and v3.&quot;</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-07-10T19:10:36.617Z
Answers.Text: These submissions were definitely made through a civi form since they had no corresponding Drupal account.
Answers.UserDisplayName: Ashe Higgs
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2015-07-08T14:51:45.717Z
Answers.LastActivityDate: 2023-01-03T23:25:29.037Z
Answers.LastEditDate: 2023-01-03T23:25:29.037Z
Answers.UserDisplayName: Laryn
Body: <p>I ALREADY had reCaptcha enabled in Civi and on my Profile type, but it seems that spam bots were still making submissions to CiviCRM and creating contacts (and got assigned to a group).</p>
  <p>I only recently caught it because I turned on role synching between civi and drupal and saw spam accounts popping up assigned a role other than &quot;authenticated&quot;.</p>
  <p>After going back through the particular group in question (in civi), I noticed that there were contacts that had Civi IDs but not Drupal (I'm assuming submissions before I turned on role syncing. I didn't load sample data when I installed civi)</p>
  <p>I'm not even sure what the URL would be for the form where bots could create a contact record...</p>
  
Tags: <contacts><duplicate-contacts><spam>
Title: How can I prevent spam bots from making submissions to CiviCRM?
ThreadText: # How can I prevent spam bots from making submissions to CiviCRM?
  
  (Asked by: username_0 on 2015-07-08)
  
  I ALREADY had reCaptcha enabled in Civi and on my Profile type, but it seems that spam bots were still making submissions to CiviCRM and creating contacts (and got assigned to a group).
  
  I only recently caught it because I turned on role synching between civi and drupal and saw spam accounts popping up assigned a role other than "authenticated".
  
  After going back through the particular group in question (in civi), I noticed that there were contacts that had Civi IDs but not Drupal (I'm assuming submissions before I turned on role syncing. I didn't load sample data when I installed civi)
  
  I'm not even sure what the URL would be for the form where bots could create a contact record...
  
  **Tags:** contacts, duplicate-contacts, spam
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2015-07-08. Score: 2
  
  If you have a CiviCRM profile assigned to "Drupal User Registration" (as "Name and Address" is by default, I believe), then spam bots that apply for an account on Drupal will also be inserting fields from that profile into their associated CiviCRM contacts.
  
  If you aren't using the account functionality you can turn it off in Drupal (**admin/config/people/accounts**) by allowing *Admin only* account creation. Otherwise you can look into Drupal-specific spam blocking modules such as [Honeypot](https://www.drupal.org/project/honeypot).
  
  There are also [some CiviCRM-specific fraud prevention suggestions](https://civicrm.stackexchange.com/questions/2345/how-to-prevent-fraud-attempts-on-contribution-pages) that may be of interest to you.
  
  **Update:** a recent extension that relates is [Form Protection](https://civicrm.org/extensions/form-protection), which "Provides various ways of protecting forms from spam/bots including Honeypot, Flood control, ReCAPTCHA v2 and v3."
  
  > **Comments:**
  > **username_0**: These submissions were definitely made through a civi form since they had no corresponding Drupal account.  
  
  ---
  
  