Developer forum

Hi Anders

We have started to see a high number of these. Only current option is to add capthca using custom implementation.

We have started looking at providing a better solution - DW10 only. Considering capjs/pow-cap-server (can be made as part of DW) or hCaptcha (which requries an account)

We are currently building new user modules - and we are looking at a different approach where you will enter an email, get a verification link, and then complete the signup after verification.

Also we would like to see some of the submits that bypasses the spam protection in DW to understand what we can do to improve that.

BR Nicolai

Hi guys,
We have noticed something similar in the past months(s). Usually, a lot of spammers using random strings in all fields.
We have solved it (for now) by adding a regex rule on the name field. They usually fill it with a single string, without spaces.
So far, it seemed to stop them, but we are also considering adding reCAPTCHA or something similar.

Adrian

Hi Nicolai,

Do you need some information in order to investigate this further? Or do you already have a work item created for this?

Best regards, Anders

We would like to get a backend to look at so we can see the actual spam submits.

We have noticed the increased issue aswell, and have also resolved to looking at fx a name field or the like, as the spam currently follows a constant text pattern. I had a support ticket you can look up for solutions (dw9) and examples if you want (#27349), but I can also give you a list of DW 10 solutions if you prefer.

Thanks

I have seen through several sites - and it is the same thing they all see - and the same bot. 

I have 2 pull requests - a homebrew version that will fix this particular problem with repeated gibberish in many fields. But I do not think that will be a long term solution so I am not sure we will let it through.

Then we have also implemented hCaptcha for DW10.

https://doc.dynamicweb.dev/documentation/fundamentals/dw10release/releasenotes/workiteminfo.html?workitemid=26907

This first version is created in a way so it is easy to setup without changing any templates - it will inject hcaptcha to the existing antispam fields and add the hcaptcha checks to the current antispam checks.

Below is the documentation for it - just to give you an idea of how it works and what it does.

Form

The Form settings are used to activate antispam on forms. Once activated, a set of hidden input fields are generated when a form is rendered. If these fields are filled (typically by bots), or if other antispam checks fail, the form submission is regarded as spam and blocked.

The following settings are available:

hCaptcha

hCaptcha is an external bot-detection service that complements Dynamicweb’s built-in antispam mechanisms (hidden fields, timing checks, IP limits).

When hCaptcha is enabled, Dynamicweb automatically injects an hCaptcha widget into forms where antispam is active and validates the hCaptcha response when the form is submitted.

Creating an hCaptcha account

1. Go to https://dashboard.hcaptcha.com 
2. Create an account and register your site/domain.
3. Configure the site for passive / non-interactive behavior.
4. Copy the site key and secret key into the corresponding Dynamicweb settings.

Note: hCaptcha requires outbound HTTPS access from the application to hcaptcha.com for verification. This is always possible in Dynamicweb Cloud.
Note: to test hCaptcha in local development environment, refer to hCaptcha documentation: https://docs.hcaptcha.com/#local-development 

How it works in Dynamicweb

• hCaptcha runs automatically and invisibly in the background.
• No checkbox or user interaction is normally required.
• A verification token is generated and submitted with the form.
• If verification fails or the token is missing, the submission is treated as spam.

What to expect

• Improved protection against automated bots and scripted submissions.
• Minimal impact on user experience.
• No additional template work beyond existing antispam support.

What not to expect

• hCaptcha does not replace Dynamicweb’s existing antispam checks.
• It does not guarantee that all spam is blocked.
• It does not display a visible challenge unless hCaptcha determines it is necessary.

When to use hCaptcha

• Public-facing forms exposed to spam or abuse.
• User registration and comment forms.
• High-traffic forms where hidden-field and timing checks alone are insufficient.

Troubleshooting hCaptcha

If form submissions are unexpectedly blocked after enabling hCaptcha, use the steps below to identify and resolve the issue.

Forms are blocked immediately after enabling hCaptcha

Symptoms

• All form submissions are rejected.
• Users report that forms “do nothing” or return errors.
• Security logs show Missing hCaptcha token or hCaptcha verify error.

Checks

1. Verify that Enable hCaptcha is set to true and both keys are configured.
2. Confirm that the hCaptcha site key and secret key belong to the same hCaptcha site.
3. Check that the configured domain in hCaptcha matches the site domain exactly (including subdomains if used).

Resolution

• Correct the keys or domain configuration.
• As a temporary workaround, disable Enable hCaptcha to restore form submissions immediately.

hCaptcha is visible or overlaps the form

Symptoms

• A visible hCaptcha widget appears.
• The widget overlaps form elements.

Explanation

• This usually indicates that the hCaptcha site is configured for interactive mode.

Resolution

• Update the hCaptcha site configuration to use passive / non-interactive behavior.
• Ensure that “Always challenge” or forced checkbox modes are disabled in the hCaptcha dashboard.