1

I have an issue, recently I've been getting bots that subscribe to the newsletter on Magento site, which doesn't have any guest email subscription forms.

You could only sign up for the newsletter if you create an account, but those bot's don't create an account, rather simply sign up for the newsletter.

I can't seem to trace how they end up signing up. Are there any Direct links bots could punch into URL that ultimately signs-up for the newsletter? E.G.: newsletter/subscriber/new?random@email.com

I see some logs where bots get a response

POST /newsletter/subscriber/new/

Improve this question

2 Answers 2

Reset to default
2

You can simply add captcha on your site in your newsletter form and write code in controller for verify captcha filled by customer. So there is no chance of "SPAM NEWSLETTER SUBSCRIBER".

Improve this answer
3
  • I don't have a form on website, I have hidden it (commented out in code) from the front end, but sometime bots signup for guest newsletter. I
    – Icon
    May 29, 2018 at 13:34
  • I can't figure out how they sign up if there is not visible form on front-end
    – Icon
    May 29, 2018 at 13:55
  • 1
    @Icon , but spammers can call url by "www.yoursiteurl.com/newsletter/subscriber/new/" using ajax or any other method. So you can either add captcha validation or you can disable newsletter module for restrict spammer if you are not using newsletter on your site.
    – Chirag Rajput
    May 30, 2018 at 5:18
1

I assume that either there is some custom PHP file on the document root or there is some custom controller which is extending the newsletter functionality.

Both can be the culprit.

If you can't find any of the above, then check whether there are any core modifications made in the newsletter module, because default Magento code is secure enough to fight such spammers.

At the very beginning of the new subscription action, it checks the following condition:

if ($this->getRequest()->isPost() && $this->getRequest()->getPost('email')) {

That means, if there are no custom modifications made in the newsletter code, it is impossible to subscribe without form.

Improve this answer
1
  • I had a newsletter form on home page, but I have commented it out in code, it's no longer visible. If you check inspect element, you wont find it home page. That's why I though maybe there is some way they can sign up if there is not form available.
    – Icon
    May 29, 2018 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.