Form Bots 101: Protecting Your Business from Spammy Leads and Traffic Burden
Jeffrey Edwards
|Data & Analytics | March 02, 2024
From collecting leads to taking orders and providing customer service, form fields play a crucial role in user experience. However, the use of automation and bots has made forms a prime target for spammers and hackers.
A form bot is a type of automated software that submits forms on websites at a high rate, bypassing any security measures.
Here, we will explore the world of form bots to explain what they are, how they work, and most importantly, how to protect your business against their negative effects, including spammy leads, data breaches, false analytics, and more.
Form Bots: How they work and the problems they cause
Often called form-filling bots, form bots automate the process of filling out and submitting online forms. While harmless in theory, these bots are designed to fraudulently pose as a human user. They are usually used in malicious ways, and are posed to cause a business many issues.
Form bots can be used to access gated content, flooding online forms with fake or stolen consumer data, providing no real or legitimate information. For a business, the data presented seems valid and coming from a ‘real person’, with some form bots even mimicking human behavior during the form-filling process. This allows for malicious activity including phishing, spamming and other fraudulent practices that can adversely affect your business.
Unreliable leads become costly
Many companies rely heavily on paid partnerships to promote their product or services. In turn, these businesses receive leads that fill out forms on their website. Fraudsters commonly pose as a reliable partner and exploit these companies by using form bots to generate fake or bad leads, later claiming credit and collecting a large payment. In many cases, businesses do not begin to realize these leads are unreliable until after a payment has been made.
Not only that, but, as a business, the more form bots fill out your website’s forms, the more your budgeted expenses deplete. Resources become wasted chasing down leads with no tangible outcome. Budgeted email campaigns go unseen, costly methods like ad retargeting fail to produce results, and revenue of brands relying on premium content or subscriptions are lost. Over time real leads can be overlooked and become missed opportunities. Even worse, as these efforts continue, businesses can suffer a substantial financial loss.
Click Hijacking attacks increased 125% in 2022. Learn more in our State of Fake Traffic 2023 report.
Form bots create a burden on website traffic
While form bots are not real people visiting your business’ website, they are still seen on the backend as site visitors. If your site is receiving a lot of traffic, real or fraudulent, your website can become unresponsive. This can turn away actual visitors frustrated with slow loading times.
In 2018 Google reported that mobile users’ bounce rate increased by as much as 123% when page load time increased from one second to ten seconds. For a visitor filling out multiple forms across multiple competing websites, any type of additional hassle can become the deciding factor in whether or not a form is filled, creating the potential of losing multiple legitimate leads.
Your competition gets ahead
In highly competitive markets where businesses are required to be fast-paced and proactive, form bots are a serious threat. Time theft is a destructive side effect of form bots. Consider it this way – while your business is chasing down fake leads from a bot, your competition could be closing with actual leads that may have been receptive to your product or service. In an even more concerning scenario, sometimes scammy competitors use form bots with malicious intent, throwing off potential leads and burdening your website performance.
Protect your business from form bots: Strategies and best practices
With the dangers of form bots at hand, it is crucial that your business takes proactive steps to protect against fraudulent leads. Here are a few tools and best practices that your business should follow:
Set up ReCAPTCHA
With Google ReCAPTCHA, you can prevent automated software from engaging in abusive activities on your site by using a risk analysis engine and adaptive CAPTCHAs. Each visitor’s behavior is analyzed to determine whether it is a bot or a human. Visitors either receive a simple box to check or a more involved puzzle that requires identifying a picture.
ReCAPTCHA is free, easy to set up, and requires little maintenance once installed. However, advanced bots are sometimes able to bypass reCAPTCHA, so it’s important to use other spam prevention methods in addition to it.
The biggest drawback to ReCAPTCHA and similar solutions is that it creates substantial friction in the user experience. A frustrating or slow authorization process can often cause users to abandon a form, task, or checkout altogether in search of a smoother process elsewhere.
Require visitors to double opt-in
A double opt-in form requires users to confirm their email address before their submission is accepted, protecting against form bots. In this process, users fill out a form to provide their email address and then receive a confirmation email containing a link that they must click to confirm their email address is correct and that they wish to subscribe.
Although double opt-in forms provide a high level of protection against form bots, they also add an extra step to the form submission process, which will frustrate some users and often drastically increase form abandonment. For that reason, it’s best to save this technique for pages and forms that are a necessity for the user, such as forms for changing travel plans or updating account information, as opposed to using it on one-time use forms such as downloads or checkout procedures.
Add form bot traps
Form bot traps are a type of security measure designed to prevent automated bots from submitting forms on websites. Hidden fields or challenges can be created inside a form that prevents a bot from completing it, while any legitimate human users will be able to easily pass.
Another type of form bot trap is called a honeypot trap. Unlike a form bot trap, a honeypot trap is specifically designed to draw in a form bot by creating fields that only a bot could see. Using a honeypot trap, bots will automatically fill out all form fields, including hidden ones, while legitimate users would not. When a bot attempts to submit a form, website owners can detect it using a honeypot trap and take appropriate action, such as blocking the submission or displaying a CAPTCHA challenge.
Rate limiting
A rate-limiting technique restricts the number of requests or actions a service or application can handle within a given timeframe. To prevent bots from submitting forms, rate limiting can be used to limit the number of submissions made by a single IP address or user account.
One IP address might be allowed to submit 10 forms per hour, for example. Bots that submit large numbers of forms quickly will reach the rate limit and be prevented from submitting any more forms.
Various techniques can be used on the server side to implement rate limiting, for example, using a database to track how many form submissions are coming from each IP address and blocking or throttling those that exceed the limit. Rate limiting can also be handled using libraries such as express-rate-limit (for Node.js) and rate limiter (for Python).
When setting up rate limiting, it’s important to consider whitelisted IP addresses, such as IPs from your own company, so that your employees are not affected by the rate limit rules.
It’s important to note that rate limiting alone is not sufficient to completely prevent form bots, so it’s often used with other approaches, such as CAPTCHA or hidden fields, to provide a more thorough defense against them.
Use IP and Geolocation Measures
Form bots can also be prevented by using IP and geolocation measures together by identifying and blocking requests from certain locations or IP ranges that are known to be associated with bot activity.
Using this method, bots can be blocked from the traffic coming from data centers or hosting providers.
Geolocation data can be used to block bot traffic from specific countries or regions. Form submissions can be verified by comparing their IP addresses against a database of known IP ranges and their associated countries and regions.
The blocking of IP addresses and geolocations can prevent bot activity, but it can also block legitimate users if they are blocked by mistake. You can prevent this by using a form to request unblocking IP addresses or locations.
Leverage a Fraud and Bot Detection tool
While the techniques outlined above can give you some piece of mind and can be quite effective in certain circumstances, most of these tools also have significant drawbacks, such as increased friction on the user experience or heavy labor costs for your IT department. The best solution to stop form bots is to leverage a fraud and bot detection tool. Not only do these tools detect and block invalid traffic, but they also save valuable time and keep friction for legitimate users to a minimum.
CHEQ leverages thousands of security challenges to evaluate site traffic in real-time, determine whether a visitor is legitimate, suspicious, or invalid, and take appropriate action in blocking or redirecting that user. For paid traffic, CHEQ automatically updates IP exclusion lists to reflect the constantly changing threat landscape, saving you valuable time and ad spend.
Frequently Asked Questions
What is a form bot, and how does it work?
Form bots are automated software that can submit forms on websites. Using predetermined data, form bots simulate human actions while filling out forms. Forms can be automatically submitted at a high rate, bypassing any security measures designed to prevent automated submissions.
How do form bots harm businesses?
A form bot can cause businesses several problems, including data breaches, distortion of analytics, abuse of business resources, revenue loss, and email marketing issues.
How can I protect my business from form bots?
Several methods can be used to prevent form bots, including fraud detection software, CAPTCHAs, form bot traps, rate limiting, IP blocking, and double opt-in forms.
What are some signs that my business may be a target for form bots?
The number of form submissions from a single IP address, the number of submissions with invalid or fake data, and the number of submissions in a short period of time may indicate that a business is a target for form bots.
What should I do if I suspect that my business is being targeted by form bots?
You should take immediate action if you suspect your website or data is being attacked by form bots. Implementing security measures such as CAPTCHAs, hidden fields, rate limiting, IP blocking, and double opt-in forms can help. Additionally, you may want to consider using a service or tool that can help you detect and prevent bot activity, like CHEQ. Consult a security expert or contact law enforcement if the situation is severe.
Author
Jeffrey Edwards
Content Marketing Manager
Jeff is the resident content marketing expert at CHEQ. He has several years of experience as a trained journalist, and more recently in his career found a knack for communicating complex cybersecurity topics in an approachable yet detailed manner.
