# Massive spam on registration and contact forms

> The forms work perfectly, that’s the actual problem: hundreds of fake accounts, contact messages or reviews generated by bots arrive without any human filling anything in. It’s the opposite of a form that fails to send, and it’s handled differently.

- Source canonique : [https://allaux.fr/en/wordpress-woocommerce/problemes/spam-formulaires-inscriptions](https://allaux.fr/en/wordpress-woocommerce/problemes/spam-formulaires-inscriptions)
- Langue : EN
- Dernière mise à jour : 2026-09-30

## Direct answer

> Start in the server access logs to see where the submissions come from: a handful of IP addresses can be blocked at the firewall, a distributed network cannot. Then add a honeypot field to the form, invisible to a human and filled in by most bots. If public registration is of no use to you, untick it under WooCommerce > Settings > Accounts & Privacy.

## How I go about it

1. **Identifying the entry point** — I check which form is being targeted: registration on /my-account/, contact, product reviews, or attempts on xmlrpc.php, since each calls for a different response.
2. **Measuring volume and origin** — I check in the logs whether submissions come from a handful of IP addresses, targeted, or thousands of different ones, a distributed bot network, which changes the response needed.
3. **Setting up an invisible filter** — I add a honeypot field, invisible to a human visitor but automatically filled in by most bots, which silently rejects their submission without a visible CAPTCHA.
4. **Adding reCAPTCHA v3 if needed** — For heavier volume, I add Google reCAPTCHA v3, based on a behaviour score, with no visible challenge for a legitimate visitor.
5. **Closing off unnecessary entry points** — I limit or disable xmlrpc.php if it isn’t in use, and disable public registration on the WooCommerce side if guest checkout already covers the real need.

## What I handle regularly

- Dozens of fake accounts created every day on /my-account/
- The contact inbox receives hundreds of spam messages
- Product reviews with suspicious links show up awaiting moderation
- Repeated login attempts on wp-login.php or xmlrpc.php visible in the logs
- The form works fine for a real customer, the problem isn’t technical but volume

## Why a WordPress form attracts bots

WordPress’s default entry points — registration, comments, the contact form — have no built-in bot protection. A bot only needs to find the form’s URL and send a POST request to it directly, bypassing any visual CAPTCHA that isn’t actually verified server-side.

On a WooCommerce store, the "Allow customers to create an account during checkout" setting combined with a public /my-account/ registration page is a common target for bots specialised in mass account creation. Another entry point that’s often overlooked is xmlrpc.php, an older WordPress API regularly abused for brute-force login attempts or pingback spam, separate from the visible forms but just as exposed.

The real mitigations, roughly in order of effort: an invisible honeypot field that only bots fill in, Google reCAPTCHA v3 which scores behaviour with no visible challenge for a human, rate-limiting requests by IP address, and finally outright disabling public registration if guest checkout already covers customers’ real needs.

## A spammed form isn’t a hacked site

> Adding a honeypot or reCAPTCHA to existing forms takes a few hours, that’s configuration work. If the request volume is massive and targeted, with persistent login attempts, that can point to a broader attack needing server-level rate-limiting, closer to a security problem than form spam.

## Related pages

- **Hacked WordPress site** — When request volume goes beyond form spam and looks like a targeted attack. ([/wordpress-woocommerce/site-pirate](/wordpress-woocommerce/site-pirate))
- **Custom extension** — Adding a custom honeypot filter or reCAPTCHA check to existing forms. ([/wordpress-woocommerce/extension-sur-mesure](/wordpress-woocommerce/extension-sur-mesure))
- **WordPress maintenance** — Regular follow-up catches a spam spike before it gets worse. ([/services/maintenance](/services/maintenance))

## FAQ

### How do I know if my forms are getting automated spam or real malicious visitors?

The volume and timing pattern of submissions usually speak for themselves: a steady stream, at all hours, with similarly generated email addresses, is almost always a bot rather than people.

### The CAPTCHA I already installed isn’t doing anything, why?

Often because it’s only checked visually, without server-side validation of the response sent: a bot posting directly to the form’s URL never has to see it.

### I don’t even know what xmlrpc.php is, should I worry about it?

It’s an older WordPress API, separate from your visible forms, regularly targeted by automated login attempts. I check whether a plugin uses it before limiting or disabling it.

### Will blocking bots get in the way of real customers registering?

A honeypot is invisible to a human visitor, and reCAPTCHA v3 doesn’t ask for any action when behaviour looks normal: both are designed to add no friction for a real customer.

### Do I really need to disable public registration on my store?

Only if guest checkout already covers your customers’ real need. Otherwise I’d rather filter account creation than shut the feature off entirely.