How can I protect my Magento site from spam?

Question

I#'m using 1.9.2.0 and the rwd theme, however since our site went online I'm getting many spam Mails via contact form. I already downloaded the Re-Captcha extension but it doesn't fit in our theme. How can I protect my site from spam?

Answer 1

As you have mentioned Re-Captcha isn't fit in your theme. A CAPTCHA is not very user friendly and statics have shown that it can be cracked. This free solution to prevent spam might be very useful to you.

The design of this extension reduce the size of your database entries and all spam messages are saved direct into a local text file. This extension is free to use.

URL : https://github.com/mgtcommerce/Mgt_Akismet

Answer 2

You can use the Google reCaptcha and create a module with an observer for this event: controller_action_predispatch_contacts_index_post

In your app/design/frontend/package/theme/template/contacts/form.phtml add the reCaptcha code from google in the contacts form (replace the "your_site_key" with yours)

<li>
    <div class="input-box">
        <div class="g-recaptcha" data-sitekey="your_site_key"></div>
    </div>
</li>

Then add the javascript file to your head section: <script src='https://www.google.com/recaptcha/api.js'></script>

In Package/Modulename/etc/config.xml

<frontend>
    <events>
        <controller_action_predispatch_contacts_index_post>
            <observers>
                <package_modulename_check_captcha>
                    <class>package_modulename/observer</class>
                    <method>checkCaptchaOnContact</method>
                </package_modulename_check_captcha>
            </observers>
        </controller_action_predispatch_contacts_index_post>
    </events>
</frontend>

Then in your observer: app/code/local/Package/Modulename/Model/Observer.php

class Package_Modulename_Model_Observer 
{
    const GOOGLE_CAPTCHA_URL = 'https://www.google.com/recaptcha/api/siteverify';

    public function checkCaptchaOnContact($observer)
    {

        $controller = $observer->getControllerAction();

        //Get the recaptcha response
        $recaptchaResponse = $controller->getRequest()->getPost('g-recaptcha-response', '');
        $errorMessage = Mage::helper('core')->__('Invalid Captcha provided');

        //If recaptcha is not empty
        if ($recaptchaResponse != '') {
            $params = array(
                'secret' => $yourSecretKey, //You will need to populate this field.
                'response' => $recaptchaResponse
            );

            //Post the data
            $curl = new Varien_Http_Adapter_Curl();
            $curl->connect(self::GOOGLE_CAPTCHA_URL);
            $curl->setConfig(array('timeout' => 15, 'header' => false));
            $curl->write(Zend_Http_Client::POST, self::GOOGLE_CAPTCHA_URL, '1.1', array(), $params);
            $jsonResult = $curl->read();
            $result = json_decode($jsonResult);
            //Check result.
            if (isset($result->success) && ($result->success == 1 || $result->success == '1')) {
                return $this;
            }
        }
        //If there is no captcha, add error and redirect back to contacts
        Mage::getSingleton('core/session')->addError($errorMessage);
        $controller->setFlag('', Mage_Core_Controller_Varien_Action::FLAG_NO_DISPATCH, true);
        $controller->getResponse()->setRedirect(Mage::getUrl('contacts'));
        return $this;
    }
}

Answer 3

With the rwd theme you don't need an extension.

You can simply enable native Magento captcha under System > Configuration > Customer > Captcha.

Enable the option and choose the contact form in the multiselect field.