How can I stop a spam attack coming from the Chat widget?

Note: If the spam is coming from your Web Widget contact form, see How can I stop a spam attack coming from my contact form?.

Question

My account received thousands of tickets coming from our Chat widget. How can I stop this spam attack?

Answer 

If you are being spammed, it's a good idea to check the IP address of each request and temporarily disable the offline Chat form.

Check if the spammer is using the same IP address for every request

If the spammer is using the same IP address for every request, you can ban it (see the article: Banning visitors). Consider banning the country of origin if your company doesn't have real customers contacting you from there (see the article: Restricting the Chat widget by country or domain).

Important: Spammers often rotate their IP address so this may only be a temporary solution. You may need to add more IPs as they emerge as spammy.

Temporarily disable the offline chat form (or widget as a whole)

Disabling the offline form altogether or the widget as a whole is the most disruptive to your workflow. However, hiding or disabling your Chat widget for a short time (5–10 minutes) is usually enough to interrupt the attack.

To disable the offline Chat form, within Chat, go to Settings > Widget > Forms and tick offline form to Off. Take a moment to read the article: Managing Offline Form settings.

Under Settings, hide the Chat widget until it is configured to appear by a trigger or the API.

1. Select Settings > Widget.
2. Click the Settings tab.
3. In the Hide Widget section, make sure the Turn off Chat Widget checkbox is not selected.
4. If you've unchecked the box, click Save Changes.

Alternatively, if you have the widget embed in your Help Center, remove the entire integration under Guide Admin > Settings > Integrations. Unselect the Chat option to make the entire integration disappear. For more information, see the article: Enabling Chat for your Help Center.

For information about cleaning up any spammy tickets that may have resulted, see the article: How can I bulk delete spam tickets in Zendesk?.