• Resolved Oliver Gelbrich

    (@ogelbrich)


    every now and then, my bookings on https://www.danielagelbrich.de/schafyoga/ get overrun by spam bookings – yesterday night, 500 fake bookings came in.

    does anyone know of an effective spam prevention method? Akismet doesn’t seem to help, i have tried Anti-Spam by CleanTalk and WP Armour – Honeypot Anti Spam…

    right now, i keep picking out the real bookings by hand and deleting the rest, but this can’t go on…

    thanks a lot, i appreciate any help you can give me.

    The page I need help with: [log in to see the link]

Viewing 9 replies - 1 through 9 (of 9 total)
  • The pro version of the plugin supports custom booking forms including support for a captcha field: https://wp-events-plugin.com/documentation/custom-booking-forms/?_highlight=captcha/documentation/custom-booking-forms/#captcha

    Thread Starter Oliver Gelbrich

    (@ogelbrich)

    Thanks for the info, @joneiseman – if there’s no other way i’ll probably have to look into that option. just sorted through 498 bookings, 2 were real.

    Denis

    (@shagimuratov)

    @ogelbrich if you open a support request, we (CleanTalk team) will do our best to figure out your case https://cleantalk.org/my/support/open

    Thread Starter Oliver Gelbrich

    (@ogelbrich)

    Thanks for your kind offer, @shagimuratov – but after getting more than 1200 bookings in less than 30 mins, I worked out a solution myself in the meantime. maybe this helps someone else, too:

    I’m using Events Manager’s Phone field ‘dbem_phone’ as a honey trap – i hid it using CSS and added this code snippet to functions.php (or you can use any code snippet plugin to insert this):

    add_filter('em_booking_validate', 'block_booking_if_phone_filled', 10, 2);

    function block_booking_if_phone_filled($result, $EM_Booking) {
    // Check the field 'dbem_phone'
    if (isset($_POST['dbem_phone']) && trim($_POST['dbem_phone']) !== '') {
    $EM_Booking->add_error('Actually, you shouldnt even see the field for phone - unless youre a spam bot – Hmm.');
    return false; // block booking
    }

    return $result;
    }

    this script checks if the input field for phone number ‘dbem_phone’ is empty or not – if it isn’t, the booking gets blocked. since human users can’t even see the field and would leave it empty, only bots get blocked. this works fine for me at the moment – spam bookings have stopped dead.

    yay, i guess.

    adding a honeypot should maybe be a standard feature of future events manager forms?

    fyi @joneiseman

    Denis

    (@shagimuratov)

    @ogelbrich thank you for the feedback and sharing the solution! Anyway, we are going to retest protection for Event manager and release an update if anything works wrong.

    rborsari

    (@rborsari)

    I am having a similar problem but the bookings appear to be something generated by the bookings function itself. Every time I view the bookings more bogus bookings appear but they contain strange data. The name field is selected from the first name field of some random actual user. Same for email address randomly selected from list of actual users. The phone number is always something from a foreign country. I delete them but they again start appearing almost immediately. Is this something inadvertently introduced in the latest release, 6.6.4.4? If it is not something that can be fixed soon, I will resort to Oliver Gelbrich’s workaround.

    hhdu

    (@hhdu)

    The honeypott With Phonenumber was a good idea, but I’ve got the first spams with a phonenumber. is there no way für captchas?

    Regards

    joneiseman

    (@joneiseman)

    I think the phone number was a hidden field so only bots would fill it out.

    okay, i understand.

    i changed the code of the Plugin and it seems to work.

    Many Thanks!

Viewing 9 replies - 1 through 9 (of 9 total)
  • You must be logged in to reply to this topic.