Stop Salesforce® Web To Lead Spam
This article will describe why you are receiving Salesforce spam and how to stop it. The first thing to check is the source code of the web page where you have a web lead form that goes to Salesforce. If you have a hidden field named “OID”, this is the source of the problem. Spammers now have your Salesforce account number and can send spam directly to Salesforce. Even if you remove the website form you will still have a problem and receive spam in your Salesforce account. Salesforce will not issue a new OID number for your account. To avoid this issue in the future, you can remove the hidden field with the OID number and pass it in server side coding before sending the information to Salesforce. This can be done in any scripting language such as PHP. To stop the spam that is currently going to your Salesforce account you can setup Lead Validation Rules within Salesforce that will check input data and flag anything with specific words or characters.
Salesforce web-to-lead security
Web_to_lead form example that can cause spam to enter Salesforce database.
<form action="https://www.salesforce.com/servlet/servlet.WebToLead?encoding=UTF-8" method="POST">
<input type=hidden name="oid" value="0hxx0TRgyZ0xxxx">
<input type=hidden name="retURL" value="http://example-domain.com">
Salesforce web-to-lead validation rules examples.
The following programming validation rule for stopping any form submission with FieldName containing the words “bad word” or if the length of the FieldName is greater than 20 characters. This spam filter limits invalid data from entering Salesforce via api.
LEN(FieldName) > 20)
Salesforce’s web to lead captcha
If your OID isn’t in the HTML source code and you are still receiving spam, there are many methods to prevent the spam without using a spam filter. You will need some programming added to your form processing application. Captcha isn’t recommended since it’s annoying for most users and many of the open source plugins don’t effectively stop spam.
So, why are you receiving spam in the first place? It’s a good idea to check the mail logs on the server to make sure you don’t have insecure code and are victim of email injection. If this is the case, your server could be sending spam to other people & communities.
Steps to stop the spam
- 1. Remove Salesforce account number (OID) from the HTML code.
- 2. Pass the OID using PHP or other programming script.
- 3. Setup validation rules within Salesforce to stop current spam.
Get Your Problem Solved Today!
Need Help? Get your problem solved today. I’m currently offering a limited but free website audit. See if you qualify.