Question

I recently made a portfolio website and put it online on 000webhost.com. Today when I logged in, the account was suspended because someone sent more then 70 emails in a minute via my contact form – something that the webhosting does not allow.

I am looking for some way to stop this from hapening again. I used both php and javascript/jquery for form validation.

This is my curent php validation code.

$firstName = $_POST["firstName"];
$lastName = $_POST["lastName"];
$email = $_POST["email"];
$message = $_POST["message"];
$to = "[e-mail]";
$subject = $firstName . " " . $lastName;
$headers = "From: " .$firstName . " " . $lastName . "\r\nReply-To:" . $email;

 if(validateEmail($email)){
     @mail($to , $subject , $message , $headers);

 }

validate($firstName , $lastName , $email , $message);
function validate ($firstName , $lastName , $email , $message){
    if(!empty($firstName) && !empty($lastName)  && !empty($email) && !empty($message)){
        if(validateEmail($email)){
            header("refresh:5; url=http://www.foxteam.net");
        }else{
           header("refresh:0; url=http://www.foxteam.net/contact.php");
        }
    }else{
       header("refresh:0; url=http://www.foxteam.net/contact.php");
    }
}   
function validateEmail($email) {
    $pattern = "^[A-Za-z0-9_\-\.]+\@[A-Za-z0-9_\-]+\.[A-Za-z0-9]+$";
    if(preg_match("/{$pattern}/", $email)) {
        return true;
    }else{
        return false;
    }
}

Can anyone tell me how can I stop spammers to send spam emails?

Answer 1

It’s very hard to stop spam coming through a contact form completely, however there are a number of methods you can use to reduce it, some of which include:

1. Use a honeypot – the idea behind this is to have a hidden field on your form with a generic name (e.g. answer), if this field has anything in it, then don’t bother sending the email (but still tell the user that the email has been sent) – it is obviously spam as there is no other way the field could have been filled out.
2. IP limiting – store the user’s IP address somewhere and limit the number of emails per minute/hour that each IP address can send.
3. Word filtering – have a list of words, if any are found then don’t send the email (usualy words like viagra, penis, etc).
4. CAPTCHA, to me, this is a last resort. If you do use one, implement recaptcha, it is by far the best one around. But as I say, use this as a last resort, there are plenty of other methods you can use without annoying the users of your website.