Stop spam sent from PrestaShop forms

Reviewed on September 8, 2026 2 min read spam CAPTCHA PrestaShop

If the shop's mailbox receives a large number of Mail delivery error notices, check where the messages are coming from before changing the PrestaShop configuration.

One possible cause is that automated systems fill in a form with other people's addresses and the shop sends replies or confirmations to them. They may also be forged messages or come from another script, so check the headers, delivery tracking and web logs before identifying the source.

Update PrestaShop, the theme and the modules; disable any forms you do not use and protect all confirmed entry points with server-side validation, rate limits and a compatible anti-bot solution. A CAPTCHA can reduce automated abuse, but it does not fix a vulnerability or replace those controls.

The following guides are historical and should only be used for old installations while their migration is being prepared:

PrestaShop 1.6 is out of support. Do not keep a public shop on that branch relying solely on a CAPTCHA.

Contain and check

If you confirm the form, temporarily disable its submission or the abused auto-reply, while keeping an alternative contact channel. Check the queue before re-enabling it so you do not release pending fraudulent messages all at once.

Test the legitimate form and one without valid verification. Check that a copy of the text entered by the attacker is not sent to any address they choose. Then monitor delivery and the logs for the affected path; the bounces stopping does not by itself prove the sending has stopped.