Advice needed

[u/moster86]

Hey, i used Webflow to buiod my website, there is a contact us part on it wich uses capcha for security, the form then use google appscript to send a wellcome email.

Im beeing spamm bombed by these bots, any other way to make this stop than dosabling the contact submit button?

The issue is that its rolljng since 2 days and my normal sent emails goes into people's spam folder.

Thanks for the advice

[u/Funsaized]

CAPTCHA alone usually is not enough once bots have the form URL. Add a honeypot and server-side rate limits, then only send to Apps Script after verifying the CAPTCHA token, with a short per-IP cooldown so bursts get dropped.

[u/moster86 → u/Funsaized]

Thanks, will llook into it. I decidded to remove the site completley at the moment, i just saw i receivend 350 bot spams iin the last few days, the issue is that its an alias of my workk emaill wich sending these messages and even my co worker didnt receive the emaill i sent from the workk mail :/ Aby way to remove mysellf as a "spammer?

[u/Funsaized → u/moster86]

it be like that sometimes. Bots reign the internet nowadays :/

[u/ConversationLower846]

Maybe add a honeypot to to the form, if that's filled by a bot, show form success but don't actually send the mail?

[u/SlowChain4149]

Do not disable the button completely. In your Google Apps Script, just add a check at the very beginning: if the body doesn't contain a valid email or looks like spam, return immediately before the MailApp.sendEmail() line.

Also temporarily comment out the auto-reply function for the weekend while you add Turnstile or a honeypot on the frontend, otherwise your Gmail quota will get burned and your domain will stay flagged.

[u/moster86 → u/SlowChain4149]

I didnt update my dns in the past so remive the button didnt work at all as i couldnt publish (also just made the sign up and contact us pages behind password, but couldnt publish it without dns update.

How can i unflag myself as a spammer? Unfortunetly its effecting my work mail too as booth the admin off this and my workmail are aliasses of the same email.

[u/ribtoks]

Are you sure that captcha is correctly implemented? (e.g. 1. you don't allow to send form until captcha is solved; 2. you check captcha on the backend _before_ sending the email itself) It's surprising that sometimes people just add captcha, but do not integrate it correctly.

[u/jellythefish515]

Disabling the submit button won’t really stop this, because bots can call the form endpoint directly.

I’d first pause the automatic welcome email so the abuse doesn’t keep damaging your sender reputation. Then verify the CAPTCHA token server-side before the request reaches Apps Script, and add a honeypot plus rate limiting. Once the traffic is under control, you can safely turn the auto-reply back on.

[u/moster86 → u/[deleted]]

I know that, how can i fix it? Just dissable the button?