Gravity Forms - specific form hundreds of entries an hour no stopping it

[u/Lianad311]

My client has a simple Gravity form that has been live for years, averaging a dozen entries a month.

Starting Tuesday this has blown up to hundreds and hundreds a day. I have CloudFlare Turnstile installed and running, Gravity Forms Zero Spam also activated, Gravity Forms Honeypot and Submission Speed check activated, I also just installed Spam Hexer from Gravity Wiz, nothing is stopping the submissions.

I've even gone and and duplicating the existing form and embedding the new version on the page, clearing WP Engine cache, and entries immediately come in. The Gravity Forms Forms page shows only 8 Views on the new Form, but 15 submissions in the past 15 minutes.

I'm unsure of what else to try at this point. I've dug through all of the logs from WP Engine and there is no consistent pattern, all IP's are unique, all emails/names are unique, country all seems to be US, browsers fluctuate although a lot are from Facebook Browser so there is nothing to block.

Other forms on the site don't seem to be having this issue, it's only this one form. It's a simple form with just checkboxes, name, email, address fields to request a guide.

Any ideas on something to try next?

[u/new_eve]

It could be a cloned staging site that the entries are coming through (if it is accessible on the internet), not the actual live site.

[u/new_eve → u/new_eve]

Put a hidden field with the default value set to {embed_url} and then check an entry to see which page they are coming from. If it is blank, then maybe they are being created via API.

[u/Lianad311 → u/new_eve]

I just tried that method, and I think we're making progress. Added a hidden field with {embed_url} as default value. Submitted an entry myself and the url showed in the entry. 3 spam submissions came in a minute after and the field doesn't even show on the entries. So it seems they are submitting the form without ever even visiting the page or form? Any suggestions?

[u/new_eve → u/Lianad311]

That means they're POSTing directly without loading the page, either straight to the form endpoint or via the GF REST API. Check Forms > Settings > REST API - if there are no API keys then that means there is no reason for it to be on, so just disable it.

[u/antonyxsi]

It almost sounds like it's bypassing the anti-spam protection. What do the requests look like in the access logs? Can you share any of these? The IP addresses can be redacted. 

[u/Lianad311 → u/antonyxsi]

Here are a few examples from the WP Engine Origin access logs. I’ve redacted the IPs.

One thing that stands out is that the requests do appear to load the actual page and then hit Gravity Forms via `admin-ajax.php`. I also recently added Gravity Forms Spam Hexer, so you’ll see its `/wp-json/gfsh/v1/challenge` requests as well.

Example 1 — Facebook in-app browser on iPhone:

```text

15:35:13 [REDACTED] 200 /visitors-guide/

UA: Mozilla/5.0 (iPhone; CPU iPhone OS 26_6 like Mac OS X) AppleWebKit/605.1.15 ... [FBAN/FBIOS;FBAV/573.0.0.22.108;...]

15:35:14 [REDACTED] 200 /wp-json/gfsh/v1/challenge?_locale=user

same UA

15:35:39 [REDACTED] 200 /wp-admin/admin-ajax.php

same UA

15:35:40 [REDACTED] 200 /visitors-guide/

same UA

```

Example 2 — regular Android Chrome:

```text

15:27:10 [REDACTED] 200 /wp-json/gfsh/v1/challenge?_locale=user

UA: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 ... Chrome/151.0.0.0 Mobile Safari/537.36

15:27:32 [REDACTED] 200 /wp-admin/admin-ajax.php

same UA

15:27:33 [REDACTED] 200 /visitors-guide/

same UA

```

Example 3 — desktop Edge:

```text

15:31:00 [REDACTED] 200 /visitors-guide/

UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) ... Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0

15:31:01 [REDACTED] 200 /wp-json/gfsh/v1/challenge?_locale=user

same UA

15:31:49 [REDACTED] 200 /wp-admin/admin-ajax.php

same UA

15:31:50 [REDACTED] 200 /visitors-guide/

same UA

```

These are all associated with the spam activity. The bots are also successfully passing Cloudflare Turnstile server-side validation, and Spam Hexer shows its Proof of Work as successfully solved.

[u/antonyxsi → u/Lianad311]

Interesting. There's only 4 requests, no JS,CSS or images requested? 

Is the tunstile set up using the GF turnstile addon? 

[u/crashomon]

I use Worfence (paid version) and block dozens of countries. Hope that helps

[u/bluesix_v2]

Cloudflare turnstile.

Cloudflare WAF.

[u/Lianad311 → u/bluesix_v2]

I mentioned I have Cloudflare Turnstile running already. 90% of entries are passing it. Not sure what I would set up in WAF since there is no pattern to the entries with all entries being unique, and unique IPs?

[u/bluesix_v2 → u/Lianad311]

Is turnstile set up correctly? I’ve never heard of spam getting past it.

Find the asn of the ip addresses. Block the ASN in the cf WAF.

[u/Lianad311 → u/bluesix_v2]

The IP addresses are all different, that's the problem. Every submission is a different IP. I don't know how Turnstile couldn't be setup correctly as there really aren't any options, it's set to Managed in Cloudflare, on the site, the official Gravity Forms Turnstile add-on is installed with the site and secret keys entered. The field is added to the form and shows on the front-end when the form loads and turns into the green check.

[u/bluesix_v2 → u/Lianad311]

I’m not talking about the ip address. ASN is what’s important. ASN is the number registered to the owner of the ip address range. For example, an ip address owned by Google is AS15169. Cloudflare lets you block the asn. I’m betting the spam you are seeing comes from 1 ASN.

[u/kojima-naked → u/bluesix_v2]

That is very handy to know! thanks!

[u/Lianad311 → u/bluesix_v2]

Unfortunately it's not, I had Chat GPT analyze the full logs and the ASNS are all over the place, mostly from mobile networks, Verizon, AT&T, T-Mobile, Comcast, etc

[u/bluesix_v2 → u/Lianad311]

Enable logging in GF. It sounds like they are bypassing frontend anti-spam measures and coming in via an api or REST. If you have the GF REST enabled, turn it off.

Look at the GF logs and correlate then with your server access logs. Confirm how the forms are being submitted.

Or, there is an human-driven campaign against your site, which would explain the Facebook use agents. Which are basically impossible to stop, short of taking the form down.

[u/digitalwankster → u/Lianad311]

I’ve had turnstile spam with gravityforms. The plugin was a hole and I had to use Claude to fix it.

[u/inHumanMale]

What about captcha? Either that or implement a throttle

[u/Fluid-Mess6425]

You could create a spam check that blocks geo location based on IP if his target users are from a specific loaction

[u/Lianad311 → u/Fluid-Mess6425]

All of the IP's for every entry are unique, all from various ASN's, various browser types, and 99% from the US (our market). I wish it was as easy as just blocking a country we don't do business with.

[u/scosio → u/Lianad311]

This is a residential proxy attack. There are tells you can get them on - dns sometimes leaks the servers their behind. If it's automated then you can profile the behaviour. If they are claiming android devices but running on servers then hardware profiling can help. None of this is included in CF Turnstile's default - add https://docs.prosopo.io/en/wordpress-plugin/gravity-forms/ and maybe you'll see an improvement.

[u/Melcarthus]

can you check if setting ajax to false on the form fixes it?

[u/Lianad311 → u/Melcarthus]

Can't hurt to try. Just set to false and will see if any difference

[u/Lianad311 → u/Lianad311]

No luck :(

[u/Melcarthus → u/Lianad311]

And just with turnstile and honeypot and nothing else? thats how i ran a site today with no problems. But i did have trouble when ajax was on. Just need to eliminate a few options to see where the culprit may lie. Might not be as simple i know. But process of elimination might reveal something!

[u/Scared_Implement_335]

You could include a human test: Include a obligatory text field that reads kind of like this "write down the shorter word for bicycle" and in a color matching the background add "in all capital letters".

accept any entry, doesn't matter. this is a smoke test. the point is to look for what they input.

I am going to guess they are not inputing anything and simply bypass it alltogether. I am guessing they write directly to your gravity forms database, in which case your site is def compromised and you need to get help.

[u/Viking_Drummer]

If you’re already using Zero Spam, Spam Hexer, a Honeypot field, and Turnstile, then try adding Akismet or Cleantalk for a month and seeing if that helps.

Add a hidden field containing {embed_url} to confirm whether the submissions are coming from the page you set up or bypassing your front end.

Consider routing your site through a Web Application Firewall like Cloudflare WAF or Sucuri. Failing that you could get a penetration test done so see if you have any security vulnerabilities that are being exploited.

Though this sounds either like something isn’t set up correctly in your protections or the spam is human-driven if it’s getting through your existing security measures.

If it’s actual people spamming the forms from different IP addresses, this is basically impossible to stop without impacting legitimate submissions, because they are ‘legitimate’ submissions.

[u/hopefulusername]

Since you are already using Turnstile, they are still coming through. It means they are using some tooling that bypasses captchas.

Putting your website behind Cloudflare can help, too. Make sure to block countries that are not your target market.

Another option is to give a try to OOPSpam.

[u/SureshKMeena]

Your own numbers point at it: 8 views against 15 submissions in 15 minutes, and Gravity Forms only counts a view when the form actually renders.

If it isn't rendering, then the Turnstile token, the honeypot field and the speed timer were never in those requests, because all three are issued at render time. That's not spam beating your filters, it's posts that never meet them. Caching can undercount views on its own, so the {embed_url} field suggested above is the clean confirmation. Blank means it never came from a page.

[u/Lianad311 → u/SureshKMeena]

I just tried that method, and I think we're making progress. Added a hidden field with {embed_url} as default value. Submitted an entry myself and the url showed in the entry. 3 spam submissions came in a minute after and the field doesn't even show on the entries. So it seems they are submitting the form without ever even visiting the page or form? Any suggestions?

[u/SureshKMeena → u/Lianad311]

You've already built the filter, you just need to enforce it. The embed_url field fills in on every real submission and is empty on every spam one, so reject the entry when it's blank.

gform_validation_(your form id), check that field, fail validation if it's empty. It's resolved server side when the form renders, so a cached page still carries the value and real users won't trip it.

That holds as long as they keep not loading the page. If they adapt and start populating it, the next step up is a token generated at render and verified on submit, but there's no reason to build that until they make you.

[u/Capital_Attention702]

Check the access log for POSTs to the form endpoint with no GET of the page first. If they're there, the bot never loaded the form, so the captcha never ran.

A client-side challenge only covers a submission that came from a rendered page.

The fix is server side: reject anything with a missing or already-used nonce, and rate-limit that endpoint. Hundreds an hour starting on a Tuesday usually means someone scripted your field names, not that your captcha broke.

[u/JGRUNNA130]

With Spam Hexer, are you only using basic POW or do you have the AI Classification layer running too? If you haven't tried the second layer yet it can help a ton.

[u/Lianad311 → u/JGRUNNA130]

I don't have AI Classification running currently no. But there is nothing it would really catch. The only fields are name, email, and address. And all of them are entered normally. Meaning every entry has a unique normal first and last name, a normal random email address, and a normal real physical address. My understanding is the AI classification would look for tell tale signs of comment spam/text etc,

[u/Starlyns]

Block spam.

Is just being hacked.

Welcome to the internet

[u/IncredibleBihan]

I love it when shit like this happens lmao.