Prevent gobbledegook submissions to web contact forms

Question

I have a PHP web contact form I put together which checks for spam words and cleans out any HTML coding before sending, but I am receiving some messages with gobbledegook, which I believe the sender is sending out. For what reason I cannot gather other than to see what they can get from it?

Example

RULITldVgsx
tMeIkngCroURjmD
OEThYoJiXWBvte
hrqWJFdKnlx

Message:
ZKIqcNxhtdPG

From: rOjhZkYyBMG [email address removed for this example]

How do I check for this sort of thing using PHP before sending, so it can be rejected like spam messages?

I have seen pspell_check but I feel that this could reject a message which could have a genuine typo in it.

Note: I have extensively tested the contact form sending code by sending test messages through it and all messages go through as they should so it's not the PHP I have put in that is garbling the message

Answer 1

I think pspell is the wrong approach: misspellings can and do happen -- and of course there are words like proper nouns that even if spelled correctly might trigger an error in pspell.

We had a similar issue with account signups on our website. More or less random information was being used to create the account. It turned out (not surprisingly) that all of these fake submissions were created by bots, so we added a captcha to our sign up form and the problem was solved. It wasn't a huge problem to begin with, but we went from a couple of dozen fake accounts a day to basically zero.

For our purposes, we decided to use reCAPTCHA v3 because it doesn't even require any user interaction, it was easy to set up, and it was free (see: https://developers.google.com/recaptcha/docs/versions). That said, there are dozens of alternatives should you prefer. Regardless, judging by the type of data you're getting, I'm pretty certain your issue is being caused by bots too and a captcha or other human-verification system should solve your problem.

As an aside, you may wish to check your log files to see which networks, countries, etc. are responsible for these fake submissions. My guess is you'll start noticing some patterns. We did. So we tightened up the security checks for certain types of data coming from certain countries -- and banned other networks entirely from accessing our system (think: large, shady server farms in countries where internet lawlessness is rampant.) If you decide to go the ban route, you can do so on the application level (such as in your PHP scripts), in your web server configuration (e.g., httpd.conf) or by using a third-party service such as CloudFlare. (In addition to doing IP checks, CloudFlare allows you to ban entire ASNs which I find super useful.)

Good luck!

Answer 2

Another good solution is to create a verification word for sending. I have noticed that in many forums, you need to answer some questions first before posting a message.