[SalesForce] Can web-to-lead be protected from spammers without additional server side processing

The default web-to-lead functionality that Salesforce provides makes it really easy to drop an HTML form onto any web page and submit leads straight into a Salesforce Org.

E.g.

<form action="https://www.salesforce.com/servlet/servlet.WebToLead?encoding=UTF-8" method="POST">

    <input type=hidden name="oid" value="00D100000000001">
    <input type=hidden name="retURL" value="http://">

    <label for="first_name">First Name</label><input  id="first_name" maxlength="40" name="first_name" size="20" type="text" /><br>
    <!-- Additional fields -->

    <input type="submit" name="submit">
</form>

Looking at the generated HTML the only input that is unique to your Org is the oid. Once a bot/spammer has that they could easily POST data to /servlet/servlet.WebToLead and create as many leads as they want (upto the default 500 per day).

While it is great the web-to-lead is so easy to implement it opens you up to receiving lots of form scrapping spam. Worse still, once your OrgId is out in the wild and they know you are using web-to-lead you can't just fix up the form to stop the spam coming in. You'll be forever trying to pickup the pieces with validation rules and field validation. See also – Ideas: Web 2 Lead & webform spam

Since the oid/OrganizationId is so sensitive it seems like it shouldn't be in the form in plaintext and ideally shouldn't even be sent to the client.

Do people just resort to server side processing to create the lead (and hide the OrgId) or is there a way to secure the generated form?

Of course, once you are doing server side processing you don't really need to use web-2-lead and can use the APIs instead.

Best Answer

New Spring 17 Feature

Both Web-to-Lead and Web-to-Case now have out of the box reCAPTCHA support. When creating the form you will now see "Enable spam filtering (recommended)" and "reCAPTCHA API Key Pair" fields:

web-to-lead

recaptcha

Here's the former solution, without using CAPTCHA:

  1. turn the "URL" field into a dedicated honeypot / gotcha on your Web-to-Lead form. Render it invisible using CSS, and then when you see a Lead come in with LeadSource='Web' and !ISEMPTY(URL) you can blackhole it. (Subject to your existing business processes of course)

  2. pull the oid organization id value out of the hidden field and populate it later using JavaScript: <script>document.getElementById('oid').value = '00Dd00000001234';</script>

These will choke most dumb scrapers and keep spam to a manageable level.

Related Topic