Last Updated: July 10th, 2018 by Dan Astriden

Stop Salesforce® Web To Lead Spam

Salesforce spam

This article will describe why you are receiving Salesforce spam and how to stop it. The first thing to check is the source code of the web page where you have a web lead form that goes to Salesforce. If you have a hidden field named “OID”, this is the source of the problem. Spammers now have your Salesforce account number and can send spam directly to Salesforce. Even if you remove the website form you will still have a problem and receive spam in your Salesforce account. Salesforce will not issue a new OID number for your account. To avoid this issue in the future, you can remove the hidden field with the OID number and pass it in server side coding before sending the information to Salesforce. This can be done in any scripting language such as PHP. To stop the spam that is currently going to your Salesforce account you can setup Lead Validation Rules within Salesforce that will check input data and flag anything with specific words or characters.

Salesforce web-to-lead security

Diagram of how to stop spam going to your Salesforce account

Web_to_lead form example that can cause spam to enter Salesforce database.

<form action="https://www.salesforce.com/servlet/servlet.WebToLead?encoding=UTF-8" method="POST">  
<input type=hidden name="oid" value="0hxx0TRgyZ0xxxx">  
<input type=hidden name="retURL" value="http://example-domain.com">

Salesforce web-to-lead validation rules example.

The following programming validation rule for stopping any submission with FieldName containing the words “bad word” or if the length of the FieldName is greater than 20 characters.

AND(
OR(
ISPICKVAL(FieldName,”bad word”)),
OR(
  LEN(FieldName) > 20)
  )

 

Salesforce’s web to lead captcha

If your OID isn’t in the HTML source code and you are still receiving spam, there are many methods to prevent the spam without using a spam filter. You will need some programming added to your form processing application. Captcha isn’t recommended since it’s annoying for most users and many of the open source plugins don’t effectively stop spam.

Hint. Many posts on the web suggest to use CSS to hide a form field on the website form and kill the form processing script if text is detected in this field. This is no longer effective against spam and a better method is to use javascript or jquery to add / remove / modify form content before the form is submitted and then check in the form processing script to make sure the content matches.

So, why are you receiving spam in the first place? It’s a good idea to check the mail logs on the server to make sure you don’t have insecure code and are victim of email injection. If this is the case, your server could be sending spam to other people.

Steps to stop the spam

  • Remove Salesforce account number (OID) from the HTML code.
  • Pass the OID using PHP or other programming script.
  • Setup validation rules within Salesforce to stop current spam.

 

Stop Problems Before They Arise!

arrow

Need Help? Get your problem solved today. I will either fix your issues or refer you to a certified Salesforce consultant. My audits uncover issues such as this and allow you to stop problems before they begin. I’m currently offering a limited but free website audit. See if you qualify.

 

 

About the Author

Avatar for Dan Astriden

Dan Astriden Web Developer

Hello. I'm a senior web developer located in the Bay Area, California. I've been managing the web properties of several Silicon Valley tech companies for many years. Contact me for a free web analysis and see how I can improve your business.

DMCA.com Protection Status

Astriden
Santa Cruz, CA 95060
United States
(831) 291-5014
contact@astriden.com
Hours: M-F, 9:00 am - 5:00 pm

Google Map Pack services