English (US)
  1. Zendesk help
  2. Support
  3. Support advice and troubleshooting
  4. Spam and suspended tickets

How can I stop a spam attack coming from my contact form?

Ricardo Pinto
  • Edited
Zendesk Digital Resources Team
Note: If the spam is coming from your Chat widget, see the article: How can I stop a spam attack coming from the Chat widget? If the spam is coming in via web service, see the article: How can I combat spam submitted via web service?

Question

There were more than 1000 spam tickets submitted from different addresses through the web form. How do I make it stop?

Answer 

Firstly, verify the tickets are actually coming from your contact form. To do that, you can check the events of the ticket.

To view ticket events

  1. Open a ticket and view the events. For steps on viewing events of a ticket, see the article: Viewing all events of a ticket. 
  2. If a ticket is submitted through a channel other than the web form, such as Twitter or email, details about the channel appear. Therefore, you are looking for something like this:

User information in the ticket events

CAPTCHA is enabled by default to mitigate spam attacks on your web form. You can require your end-users to register and verify their email to access the web form. For more information, see the article: Requiring that your users register to use Zendesk.

If your Zendesk account has been spammed and you suddenly need to bulk delete these spam tickets, instead of manually deleting them, there are different ways to do it and they are all outlined in this article: How can I bulk delete spam tickets in Zendesk?

Return to top

11 Comments

  • Rich Trott

    This article instructs the reader to enable CAPTCHA, but the doc it links to explains that CAPTCHA is enabled by default and can't be disabled.

    0
  • Phoebe Morin
    Zendesk Customer Care

    Hi Rich, 

    Good catch! We have flagged that portion of the article for update. There were changes indeed with the product last year. It used to be the case that there was a separate setting just for Captcha. Now, it is enabled by default. One option for widget spam concerns would be the require authentication checkbox. (Captcha is no longer an option). 

    Thanks for bringing that to our attention. You're awesome! 

    2
  • Julien Maneyrol

    Hi there,

    The article says that CAPTCHA is enabled by default, yet we've never seen it during our tests. Does this mean that it is not always offered?

    If so, is there a way to force it? We have had a major spam outbreak via one of our contact form, from Chinese hosts, a couple of weeks ago. We disabled the form in question, but it'd be nice if we could re-enable it in the future.

    This would also help us filter "trash" tickets.

    Thanks

    1
  • Dave Dyson
    Hi Julien, 
     
    Users are only prompted with a CAPTCHA in certain circumstances – for more information, see CAPTCHA FAQs
     
    Hope that helps!
    0
  • Daniel Fachin

    Yeah, we're seeing the same sort of spam. All from a single domain. The mind-blowing thing is that even adding the domain to the blocklist isn't working. Really concerned ZD isn't taking this more seriously. If they're only sending Captcha in certain circumstances this needs to be greatly improved to protect their customers. 

    1
  • Natalia Lutsevich

    Yes, I totally agree. Recently there is a mass spam attack going on. It's been one month and we cannot do anything about it. When we Suspend access of the user, after a while he's still able to send us bunch of spam.

    Zendesk, are you going to do anything about it?

    0
  • Julien Maneyrol

    Hi @...,

    Thanks for your reply.

    I understand, but this is not very satisfactory. From my point of view, we - as Zendesk customers - should have the possibility to enforce CAPTCHA to everyone if we need to.

    I wish this would be considered as a possible new feature in the future.

    Best regards

    1
  • Ola Timpson

    This article doesn't seem to actually answer the question of how to stop a spam attack. It tells you how to see where the spam has come from and how to delete the spam, but nothing on stopping it.

    1
  • Dane
    Zendesk Engineering
    Hi Ola,
     
    Based on the information above, if the default automatic CAPTCHA is not enough to prevent these spam attacks, the recommendation is to require end-users to sign in before they can submit a request.
    0
  • Arno (EMEA Partner)
    • Edited

    Just to confirm, if you use just "domain.com" on blocklist, user can still create ticket with web widget form and help center form, but if you use "suspended:domain.com" or "reject:domain.com", this also applies to any tickets created via Web Widget form or help center form?

    Atleast based on short testing, this would be true. If it is, it helps with fighting spam via web widget form, we see time to time.

    0
  • Dainne Lucena
    Zendesk Customer Care

    Hi Arno (EMEA Partner),

     

    Yes, you are correct. Using the keyword "reject:" would block ticket submissions from all the channels. More information can be found here for reference.

     

    To completely block support requests from specific users, enter the keyword reject: in front of an email address or domain list in the blocklist. Tickets will not be added to the suspended tickets queue and there will be no record of the ticket in your Zendesk.

    0

Please sign in to leave a comment.

More about

Powered by Zendesk