Identify and stop abuse of a website's forms

For no apparent reason, you start receiving dozens (or even hundreds) of "Mail delivery error" emails, and when you look at their content you see they are bounces from all kinds of different addresses.

One possible cause is automated abuse of a form that sends confirmations to the address entered. Bounces can also be forged or come from another script, account or task, so they do not by themselves let you identify the source.

Check a message's headers, the delivery tracking, the real sender and the web logs for the same time. Identify the specific URL and application before installing components or blocking traffic.

The Mail delivery error notice describes a delivery problem, but the message must be checked against the logs to confirm whether it was really sent from your account.

Update the application, the theme and its extensions, disable any forms you do not use and protect each confirmed entry point with server-side validation and rate limits. CAPTCHA or reCAPTCHA can reduce bots, but they also produce false positives and do not fix vulnerabilities.

If you use reCAPTCHA, restrict the keys to the domain, keep the secret on the server only and verify each response there. Test the form with legitimate users, strict privacy settings, blockers and mobile devices.

Choose a maintained integration that is compatible with the current version of your application. Do not install plugins or modules from an old guide without first checking their official release, maintenance and permissions.

Stop the form being used to send spam to third parties

Limit the recipients the visitor can choose. In an automatic confirmation, avoid sending free text, links or attachments entered by the visitor to an unverified address. Validation must happen before the request is saved or email is sent, including for direct requests to the endpoint.

Test a legitimate submission and another without the required validation; then check the queue and the delivery tracking. If you contain the abuse by disabling a feature, offer an alternative contact method and re-enable it only after fixing and testing the entry point.