Member Avatar for HoverportMedia

Hello everyone,
I know I've been absent for a while, but it's been for good reasons. Unfortunately I'm coming at you today with a problem I've hit a dead-end with. (Furthermore, this may not be the right forum to discuss this topic).

When I landed my position last year to redevelop one of our client's webpages, there was a test form that was lingering around on the old website. Needless to say, I happened to delete that test form and any instances I could find of that code. The problem is, today, I'm still getting spam from that form.

The page is not indexed in our sitemap, nor in our htaccess. What additional steps should I take to resolve this issue?

  • 2 Contributors
  • 5 Replies
  • 237 Views
  • 5 Hours Discussion Span
  • Latest Post Latest Post by Dani

Dani AI

Generated

Short summary tied to the thread: removed the visible form and its PHP processor but continued to receive form-style spam; correctly flagged that the processing side is what bots target. The practical checklist below focuses on proving whether anything is still accepting POSTs, where the messages originate, and how to stop them quickly while finding the root cause.

Start by confirming live hits and origin. Look for POST requests or unusual activity in web and mail logs, then correlate IPs with mail headers:

# Apache example: find POSTs that reference the old handler and count IPs
grep '"POST ' /var/log/apache2/access.log* | grep 'old-form-handler.php' | awk '{print $1}' | sort | uniq -c | sort -nr

# Test the endpoint directly
curl -I -X POST -d "name=test&email=test@example.com" https://www.example.com/old-form-handler.php

# Mail logs: search for the recipient or subject used by the form
grep -i "recipient@example.com" /var/log/mail.log*

Fast mitigations while investigating. Return a 410/Gone or forbid the URL at server level so automated clients stop hitting it, block repeat offender IPs, and add temporary authentication on any live handlers. Examples:

# .htaccess (mod_rewrite) — return 410 for that path
RewriteEngine On
RewriteRule ^old-form-handler\.php$ - [G,L,G]

Or block an abusive IP immediately:

iptables -A INPUT -s 203.0.113.45 -j DROP

Follow-up checks and prevention. Search the full codebase and backups (git grep or grep -R) for copies of the handler or mail-sending calls; inspect staging sites, subdomains, CDN caches and old backups. Examine the Received headers of the spam emails to find upstream IPs and match them to webserver logs. If a third-party integration or webhook was used, revoke its keys. Long term, add a nonce/honeypot or CAPTCHA and monitor logs with fail2ban or rate-limiting.

Tie-back: combine the server-level block/410 with Search Console removal (as tried) and the diagnostic log work suggested — that sequence stops spam now and prevents recurrence.

Recommended Answers

All 5 Replies

Member Avatar for Dani

A form has two parts: the front-end form you fill out, and the back-end part that does all of the processing.

It's possible that you just deleted the front-end form itself, but there are spam bots that are hitting the back-end part directly.

Member Avatar for HoverportMedia

Sorry Dani, I should have clarified this a bit more. When I deleted the form, I deleted the back-end page of it, where the PHP processing code was. Could it possibly be that the remaining front-end (if it's still lingering) could process the form even without the back-end? Just to clarify, the forms that were created all had a back-end protocol in processing.

Member Avatar for Dani

No, that's not possible. There needs to be some back end code that does the processing in the form of sending an email, posting to a database, etc.

Member Avatar for HoverportMedia

Thats what I thought Dani, thanks - I have a sudden suspicion that the back-end of the page is being indexed through Google and it's somewhere still relevant in Google's memory. Call it a hunch if you will, but I searched high and low and can't find any other instances of where the form would be coming through. The one step I did take was to use Google's remove URL tool. Perhaps that does something. Only time will tell.

Member Avatar for Dani

No, that's not technically possible. Google is only able to retrieve front-end stuff, such as HTML / CSS / JavaScript, same as a web browser, and that's what it caches.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.