Mailform Protector for Umbraco manual

Transcription

1 Mailform Protector for Umbraco manual v By member of

2 Table of Content Table of Content...1 About Mailform Protector...2 The problem...2 Why CAPTCHA is not the solution?...2 Our solution...2 Small bonus for Umbraco users...2 Architecture...3 Antispam techniques used...3 Check 1: IP check...3 Check 2: Empty field check...3 Check 3: Completion time check...3 Check 4: URL check...3 Check 5: blacklisted words...4 Check 6: Mandatory fields check...4 Check 7: Empty form check...4 Installation...5 Requirements...5 Step by step instructions...5 Usage instructions...8 Quick start guide...8 Usage scenarios...9 Scenario 1: Single form posts to itself...9 Scenario 2: Single form posts to another page...9 Scenario 3: Multiple (but similar) forms post to single page Scenario 4: Multiple (and different!) forms post to single page Other scenarios Form actions Action 1: form data Action 2: Redirect to another page Settings explained

3 About Mailform Protector The problem As a company that builds web portals and corporate sites we noticed a spam problem with web forms. Our clients complained about spam coming through their contact forms (or they receive blank forms) and requested that we solves it. Why CAPTCHA is not the solution? Captcha is not always a good option. Visitors hate to fill it in and if those visitors are your potential customers you do not want them to feel frustrated as it is going to kill your conversion. Here is just one of many articles on this ( Akismet ( is better choice but it is commercial product which starts from 50$ per month (unless for personal use). Even then, or you have only personal site, note that Akismet is designed mostly for blog *comments*. Connecting it to contact forms or similar web forms is not so efficient as those forms usually consist of quite a few inputs and not just long comments. Our solution That s why we decided to go the other way, to implement antispam technique that does not affect conversion as it is completely invisible to visitors. Those techniques are not invented by us, they are known and used over the net (like visual hiding a field on a form; spambots still see it in the source code and fill it in which triggers spam flag). We took several of those techniques (read more about them below) and implemented as modules we use on day to day bases on sites we develop. We are using ASP classic version,.net version, DotNetNuke module and Umbraco package. After some time of using those in practice, we decided to make them public and charge a small fee only to cover costs of support, documenting, website building, etc. Small bonus for Umbraco users Since Mailform Protector sends out it is basically also classic form2mail component! Design any form in HTML, with no limitations of form builders used out there, just connect it to Mailform Protector and your form is going to be mailed to you when somebody fills it in. This way, when building a form, your only limitation is in HTML/CSS. Build whatever you want, use JQuery or not, group items with DIVs or SPANs, use images, put two or even more different forms on the same page it doesn t matter. What form builder can offer that flexibility? This is also result of us being in business of building websites for over 10 years. We believe that for any webmaster, there is no better tool to design a web form than using HTML itself and tools like Dreamweaver or notepad or whatever HTML editor you prefer. Form generators are for your non-technical clients, but if your job is to create a form then form generator is just not flexible enough. Just do whatever you do every day in your favourite HTML editor, copy/paste in Umbraco content or template, link it to Mailform protector and you re done! 2

4 Architecture Mailform protector package contains two ASP.NET user controls: 1. AntispamControlFields 2. AntispamValidator Mailform Protector user manual AntispamControlFields is a very simple web control that should be placed inside <form> tags. It inserts three hidden input fields in the html form. AntispamValidator web control performs all antispam checks and therefore should be located on the destination page (page that receives the form post). When the form containing AntispamControlFields is posted, on target page Antispam control awaits for posted data, checks those 3 fields and uses other antispam techniques described above to build up a total spam-score. Based on result, configured action is taken ( form data, redirect to another page). Sometimes form is pasted to the same page (itself). That is why we decided to include AntispamControlFields control inside AntispamValidator control. So, for implementations like this there is no need to use AntispamControlFields control AntispamValidator control will do that job by itself. This control doesn't use PostBack so there is no need to place it on the form with attribute runat= server. Any form will do. In fact, multiple forms on the same page will work! Antispam techniques used Check 1: IP check IP of the computer used to fill in form is compared to IP of computer which posted the form. It should be the same. Some spam bots separate process of downloading the form with process of mass-filling those forms. Normal users should never change IP address during this process. Check 2: Empty field check Special, visually hidden field, is used in the form. Normal visitors will not see it and will not fill it. Spam bots use source code of the page and cannot see a difference between hidden field and the real field so they fill in hidden field too. Check 3: Completion time check Time of landing on form page is compared to time filled form is received by server. Spam is suspected if this time is too short (automated scripts do this and normal visitors cannot fill in form that fast) or it is too long (spambots sometimes download forms hours or days before mass-filling them in). Check 4: URL check Fields are checked for URL strings in them. It can be fine-tuned in which fields and how many URLs are allowed and if system detects URL above that threshold spam is suspected. Most of contact forms on company sites are not expected to receive many (if any) URLs. On the other side, most spambots send many URLs through those forms. Setting up a good threshold can separate those two cases. 3

5 Check 5: blacklisted words Mailform Protector user manual Fields are checked for words contained in black list. It can be fine-tuned with custom words list, lists of fields to be checked, spam-score amount for every word matched, etc. It is not likely that your client is going to spell Viagra on your contact form so you can separate those from spambots using this check. Check 6: Mandatory fields check Form is checked for mandatory field content. It can be fine-tuned with list of mandatory fields to be checked. If any of mandatory fields is left blank then spam is suspected. This check is used together with Javascript validation on the form that you should design yourself. Spambots usually bypass this validation by disabling Javascript. If there is no server-side checking you receive incomplete forms. So, this check can be used for more than only antispam check. It can also behave as serverside check of mandatory fields-is. Check 7: Empty form check Similar as above check for mandatory fields but simpler. Even if there are no mandatory fields in a form, it is expected that at least one form field is filled in. Blank forms are never something you want to receive so that is what is checked here. Similarly as above, this check can be used for more than antispam. In example, search bots also can sometimes land on form-submitting page, and since they also disable Javascript you can end up with empty form in your mailbox. This check ensures you don t. 4

6 Installation Mailform Protector user manual Mailform Protector is installed just like any other standard Umbraco module, as a package through Umbraco back office. Requirements Mailform Protector is tested on Umbraco 4.x but we don't see any reason for it not to work on earlier versions of Umbraco as it is stand-alone.net control that does not use any of Umbraco APIs. Step by step instructions This installation guide assumes you have installed and functioning Umbraco 4.x installation. It also assumes you have bought and downloaded Mediaform Protector package from our website Step 1 choosing a package file to install Login to Umbraco control panel as admin. Go to Developer section, expand Packages and click on Install local package. You should see screen like this: Confirm that you accept security risks (DON T do this unless you got package from us or your site might be hacked). Click Browse button and find a package on your disk, where you stored it after download from our site. Finally, click Load Package button 5

7 Step 2 Loading and installing the package On the next screen, you ll need to accept a licence: You also get a warning about binary files in the package. That is normal as one.dll is used (Mailform Protector contains.net control): Click Install Package to finish installation and if all goes well, after a few seconds you ll get confirmation like this: Step 3 (optional) checking if files are installed Now, you should have 2 new macros installed, named AntispamControlFields and AntispamValidator. Search for them in Developer section under Macros node. Step 4 check web.config for settings This is not part of Mailform Protector but it uses configuration from web.config to send out . Check that this is configured correctly by opening web.config file (located in the root of your Umbraco installation) and searching for lines like this: <system.net> <mailsettings> <smtp> <network host=" " username="username" password="password" /> </smtp> 6

8 </mailsettings> </system.net> Change strings marked red to match your server setup before you ll be able to receive from forms. And that s it, Mailform protector is installed! You can now go on with configuring it for usage. 7

9 Usage instructions Mailform Protector user manual Mailform protector checks posted html form and depending on some antispam check techniques result it performs appropriate action (redirect to specific page and/or mail with form data sent out). Mailform protector uses several different techniques, or tricks, to try and detect spam. Every single check has its own weight and is used to calculate overall spam-score. By changing weights of the single check and the final spam-score limit, you can define your own spam criteria, or you can use defaults which work ok for most cases. As distinct from well-known CAPTCHA solution, there is no need to read smudged, distorted, badly colored digits and letters to be allowed filling and sending online forms. This means your conversion will NOT suffer! Quick start guide This quick start guide is for those that have a general knowledge of Umbraco and HTML and do not need detailed instructions to make it work. However, to understand all possibilities which Mailform Protector offers, please read the complete manual or at least go through usage scenarios and settings explained below. Here, we will use only the most simple usage scenario: Step1: create HTML form Use your favorite HTML editor to create HTML form for your website. Our simple example is: <form method="post" action=""> <label>name</label><input name="name" type="text"> <label> </label><input name=" " type="text"> <textarea cols="15" rows="5" name="comment"></textarea> <input name="submit" value="send" type="submit"> </form> As you can see in form action attribute, form will post data to itself. Step 2: insert form HTML in to Umbraco page Choose a page in your Umbraco site that will contain this form and copy/paste the form HTML code into content of that page. Do not save or close this page yet! NOTE: alternative way to insert HTML form in Umbraco site is to put it in page template! This is preferred way if you do not want site editors to mess with it and/or you want to avoid some issues with certain HTML tags not accepted by rich text editor. In case you ran into problems of rich text editor eating some of your form tags or attributes, read Umbraco forums/documentation about changing tinymce settings in file /config/ tinymceconfig.config to allow special HTML tags. Step 3: insert Antispam Validator macro into form You will do this by clicking somewhere inside the form (needs to be inside opening and closing of FORM tag) and then clicking on macro button in Umbraco toolbar of rich text editor. In dialog windows choose Antispam Validator macro and click ok. For explanation of each setting, if not self-explanatory, take a look at settings explained section of this document. 8

10 Click OK to confirm and insert macro in document. Save and publish page. Step 4: hide secret fields in CSS Among other techniques, Mailform Protector also uses a special text field visually hidden from normal visitors but visible to spambots in the source of the page. If this field is filled it, it is almost certain that spambot filled the form and not regular visitor. Hiding this field is on you! We suggest doing it in CSS and not by using inline styles (some spambots are very clever and can read this trick)! You can reference this filed by its name or ID attribute. Default name of this field (ID attribute too) is wendy (you can change this in settings). Simple way to hide it is by putting this in CSS: #wendy { display:none; } More advanced technique almost impossible for even most clever spambots to detect as hidden is setting its border, background color and text color to the same color as background of the page. There are many other techniques like positioning outside page boundaries or decreasing it s size to something very small, but that is more CSS topic than Mailform Protector issue. You re done! That is it! If you have entered some address to receive form data in settings above or have setup some page redirection (or maybe used debug mode), you can go on and fill the form and see what you get in . Try playing with words like Viagra> Important note! Usage scenario used in this quick start guide is very basic. Mailform Protector can be used in many different ways, with multiple forms on single to multiple pages. Keep reading to learn about it. Usage scenarios Because of flexible design and (optional) separation of form sending control (AntispamControlFields) and form receiving control (AntispamValidator), Mailform Protector can be used in many different ways. Form can post to itself (same page) or to some other page; multiple forms can be used on the same page or different pages; forms can share same settings or may have different settings, etc. Possible configurations are almost endless and some of them are described below: Scenario 1: Single form posts to itself This is the most simple usage scenario where form posts to the same Page 1 page. After posted data is processed, defined action is executed, usually that is posted data and redirect to thank you page. FORM Antispam Only AntispamValidator control is used in this scenario (between opening and closing of the <form> tag!) and IsOutsideSubmitedForm setting needs to be false. Scenario 2: Single form posts to another page 9

11 Page 1 FORM AntispamCo ntrolfields Page 2 Antispam This scenario is also simple and used frequently. We could say this is the default scenario on most simple websites. Compared to scenario 1, form is posted to another page, usually thank you page which also processes form results and executes defined actions. However, while in above scenario redirect action is often used to display thank you message, in this scenario redirect is not needed as thank you message is displayed on the same page where form is posted. In this scenario we need to use both controls, AntispamControlFields control (between opening and closing of the <form> tag on the form page) and AntispamValidator control on second page. IsOutsideSubmitedForm setting needs to be set to true or you can leave it blank as true is the default value. Scenario 3: Multiple (but similar) forms post to single page FORM 1 AntispamCo ntrolfields Form Target Page Antispam Page 1 FORM 2 AntispamCo ntrolfields Page 2 FORM 3 AntispamCo ntrolfields This is a bit more complex scenario but also widely used. It is very similar to scenario 2 where single form is posted to another page but here we add more pages with forms (or more forms to the same page, same thing). In practice, this can happen if you have your contact form on multiple locations on your website, like small version of quick contact and full version on your contact us page. What you would usually want is to simplify things and configure both forms to behave in the same way: post to same addresses, redirect to same thank you page or display the same thank you message. Instead doing the same configuration 3 times (and increasing chances for error) you can use the same form target page to process all forms. Configure each form (Antispam ControlFields control) in the same way as in scenario 2 (put AntispamControlFields control between opening and closing of the <form> tag and on form target page use AntispamValidator control with IsOutsideSubmitedForm set to true ). If you have mandatory fields on your forms, you need to list all mandatory fields from all forms in RequiredFields setting of AntispamValidator control. However, also take note that this works only for forms with same configuration! That means all forms will have to have same redirect page setting, same from and to settings, etc. It is not necessary that all fields are the same, it depends on your settings but in general you should think about following 3 things before using this scenario: 10

12 - 3 control fields should be named the same in all forms, those names are defined in AntiSpamControlFields control settings and are: PassphraseFieldName, DateFieldName, EmptyFieldName - Don t mix mandatory fields! In example, if field named is mandatory on the form of Page 1 then on other form(s) there must be no field named or it must also be mandatory! Otherwise, non-mandatory field could be posted blank and interpreted as spam. - Since single AntispamValidator control is used on form target page you can have only one setting for form processing which means all forms posted will have sender , same redirect actions defined, same subject, etc. Scenario 4: Multiple (and different!) forms post to single page FORM 1 AntispamCo ntrolfields Form Target Page Antispam 1 Antispam 2 Antispam 3 This scenario is one step ahead from Scenario 3. It deals with limitations of that method (same configuration and mixing of mandatory fields). Here, you can post any form to the same target page simply by multiplying AntispamValidator control on that target page! This way, you also multiply settings and you can setup each form to be processed the way you want it. How does each AntispamValidator control know which form to process, how are those connected? Well, FieldNamePrefixToCheck setting is used. In example, add form1_ prefix to name of each fieldname in form 1, like form1_name, form1_ , form1_message, etc. Use the same method and use form2_ to second form, also similar for third. Then, add 3 AntispamValidator controls on form target page but each control will have different FieldNamePrefixToCheck setting. One will have this field setup to form1_, one will have form2_ and last one will have form3_. This will ensure that AntispamValidator control 1 will process only fields with prefix form1_, and so on. This way, you can have single form target page with unlimited number of AntispamValidator controls configured to receive unlimited number of forms posted, each with different settings (spam settings, required fields, s to post data to, redirect pages, etc.) Other scenarios Of course, any combination of above scenarios can be used. Only 4 mostly used combinations are listed. Form actions Page 1 FORM 2 AntispamCo ntrolfields Page 3 FORM AntispamCo ntrolfields After form data is posted to form target page, AntispamValidator control processes that data, applies antispam techniques and then executes configured actions. 11

13 Action 1: form data Mailform Protector user manual This is very basic functionality (form2mail) and is executed for every form. You can choose different addresses (and subjects) that will receive form data of forms suspected to be spam and for regular forms. This way you can deal with spam in your inbox using your client s filters, taking care of those false positives. Settings used here are: - SendMailFrom - SendRegularFormBy To - SendSpamBy To - SendNoSpamBy Subject - SendSpamBy Subject Action 2: Redirect to another page This is an optional action. Usually, it is used in scenario 1 where form is posted to the same page where form is located. To be able to display thank you message in that scenario, redirect to thank you page is usually used. However, since different redirect page can be setup for each of 3 different events (spam suspected, regular mail, and error sending mail) usage scenarios are much wider than that. Redirect on spam detected and regular mail are quite self-explanatory. We can only advise you to carefully think weather those two redirect pages should be different in your usage scenario. Usually, you do not want to let know spammers that their form was detected as spam! So we suggest using same thank you page for spam detected and for regular form data. But at the same time, make sure you also receive forms marked as spam so no form posts are lost! Use different subject and configure filters in your mail client to take care of those marked as spam. Check them every now and then to make sure there were no false -positives. However, this is just suggestion that works for some scenarios. Using different redirects will work better for some. Mailform Protector is flexible, you choose what you prefer. Redirect on error sending mail is here to avoid those ugly error messages on your website when something is wrong with mail server or when sending mail fails for whatever reason. Using this setting you can redirect user to a page with a friendly error message, in case there is an error sending mail. Settings used here are: - RedirectPageAfterAntispamPassed - RedirectPageAfterAntispamNotPassed - RedirectPag SendingFailed Settings explained As there are quite a few settings, we separate them in few groups (note that Umbraco interface lists all settings together) Implementation settings: Macro property name / Default value Description Source Property name (used if left blank) Passphrase Field Name erwin AntispamValidator or AntispamControlFields 12

14 PassphraseFieldName Date Field Name DateFieldName Empty Field Name EmptyFieldName Is Outside Submited Form IsOutsideSubmitedFor m Field Name Prefix To Check FieldNamePrefixToCheck Is Debug Mode IsDebugMode charles wendy true true Mailform Protector user manual control injects a hidden field in your form that is used for IP check That field is going to be named this. Usually you want to leave it empty (default) unless for some reason you want to change names of those control fields (maybe hide the fact you're using Mailform protector?). AntispamValidator or AntispamControlFields control injects a hidden field in your form that is used for Completion time check That field is going to be named this. Usually you want to leave it empty (default) unless for some reason you want to change names of those control fields (maybe hide the fact you're using Mailform protector?). AntispamValidator or AntispamControlFields control injects a field in your form that is used for Empty field check That field is going to be named this. You should visually hide this field using CSS (read more about it in docs above). Usually you want to leave it empty (default) unless for some reason you want to change names of those control fields (maybe hide the fact you're using Mailform protector?). Set to true (ore leave blank as this is default) if the form is posted to the same page. If form is posted to another page then set it to false. Only fields with this prefix will be checked. If empty (by default) all fields in the form will be checked. This is used for debugging. If set to true, antispam report will be displayed on posted page. Also, no redirection will be done and notification will not be sent. Spam detection and scoring settings: Macro property name / Source Property name Passphrase Does Not Match Score PassphraseDoesNotMatchScore Empty Field Not Empty Score EmptyFieldNotEmptyScore Empty Form Score EmptyFormScore Min Time To Fill Form (sec) MinTimeToFillForm Max Time To Fill Form (sec) MaxTimeToFillForm Time Check Failed Score TimeCheckFailedScore Default value Description (used if left blank) 50 IP check score (added to total spam score if check is failed) 50 Empty field check score (added to total spam score if check is failed) 10 Empty form check score (added to total spam score if check is failed) 2 Minimum period of time (in seconds) allowed to fill the form. If form is filled in faster than that, Completition time check is not passed. 500 Maximum amount of time (in seconds) allowed to fill the form. If form is filled in slower than that, Completition time check is not passed. 50 Completition time check score 13

15 Fields That May Contain Urls FieldsThatMayContainUrls Url Found Score UrlFoundScore Required Fields RequiredFields Required Field Empty Score RequiredFieldEmptyScore Spam Word List File SpamWordListFile Spam Word Found Score SpamWordFoundScore Spam Limit SpamLimit (added to total spam score if check is failed) Comma separated list of fields that MAY contain URLs. Those fields will not be checked for URLs. 10 Score for every URL found (added to total spam score if check is failed) Comma separated list of mandatory fields. 20 Score for every MandatoryField check (added to total spam score if check is failed) Relative path of the file containing bad (spam) words. Default value is /App_Data/spam_wordlist.config and if it is empty (like is the case with default installation) then embedded dll file spam_wordlist.config will be used. 10 Score for every bad word found (added to total spam score if check is failed) 20 Checked form is considered as spam If total spam score is greater then this spam limit. ing settings: Macro property name / Source Property name Send Mail From SendMailFrom Send Regular Form By To SendRegularFormBy To Send Spam By To SendSpamBy To Send No Spam By Subject SendNoSpamBy Subject Send Spam By Subject SendSpamBy Subject Redirection settings: Default value (used if left blank) Antispam check passed Antipam check NOT passed Description Notification s will be sent from this address. address that will receive the antispam report if posted form IS NOT evaluated as Spam address that will receive the antispam report if posted form IS evaluated as Spam. Subject of notification when form IS NOT evaluated as Spam. Subject of notification when form IS evaluated as Spam. Macro property name / Source Property name Redirect Page After Antispam Passed RedirectPageAfterAntispamPassed Redirect Page After Antispam Not Passed RedirectPageAfterAntispamNotPassed Redirect Page Mail Sending Failed RedirectPag SendingFailed Default value (used if left blank) Description Redirect to this URL if posted form IS NOT evaluated as Spam Redirect to this URL if posted form IS evaluated as Spam. Redirect to this URL if antispam check is NOT passed and sending fails. 14