Introducing spam detection for webforms: An additional layer of protection to keep your Zoho CRM clean and secure

Introducing spam detection for webforms: An additional layer of protection to keep your Zoho CRM clean and secure

Greetings all,

One of the most highly anticipated feature launches—Spam Detection in webforms—has finally arrived!

Webforms are a vital tool for record generation, but they're also vulnerable to submissions from unauthenticated or malicious sources, which can lead to the collection of spam records that clutter CRM systems and reduce data quality. 

Zoho CRM's new spam detection capability provides an additional security layer and minimizes dependencies on the basic options such as captchas and double opt-ins, ultimately improving data quality of webform submissions. Users no longer have to check potential spam records from webforms manually.

Let's dive into how Spam Detection restricts suspected spam records from webforms and helps users keep their CRM clean and organized.

What does spam detection do?

Spam detection offers the following advantages:
  1. Simplifies the manual review of potential spam in webform submissions.
  2. Detects potential spam submissions by identifying invalid or suspicious email addresses and scoring them to indicate spam probability.
  3. Holds these possible spam records for manual approval from users.
  4. Automatically blocks spam records to keep them out of the CRM account.

What happens to webform submissions?

All webform submissions are evaluated against predefined criteria and screened for spam detection. Let's say you've received several webform submissions for the Leads module from your website visitors.

Clean, non-suspicious records that originate from verified IP addresses—and are therefore deemed likely to be genuine and valid—are fed into the Leads module (unless approval has been set for all webform submissions).

In contrast, suspicious submissions are flagged as potentially spam and held back for manual approval in the usual record approval page called, Awaiting Leads (previously known as Approve Leads). These records are assigned a Spam Possibility Score based on the identified suspicious factors. 

The new Record Source column provides details related to the submission's source—for example, the submission's IP address, the webform name, and the URL—when you hover over the info icon. 

The new Spam Possibility column indicates the spam probability for each record as a percentage. You can also view the top reasons behind the scores of the spam record by hovering over the info icon beside it. 


Each reason identified contributes to the score, and the sum is calculated to determine the final Spam Possibility Score for the record. Some of the reasons are listed below:
  1. Submission from bots/crawlers: If a bot or crawler fills and makes a submission via your hosted webform, the Spam Detection layer will automatically identify this malicious submission.
  2. Submission with invalid phone numbers: If a form respondent shares an incorrect phone number, a toll-free number, or a junk contact number, it will be flagged as an invalid phone number.
  3. Submission with invalid email addresses: If the submitted email address originates from a spam source, an unauthorized domain, or a temporary mailbox, it will be flagged as an invalid email address.
We're also introducing an advanced security layer: Honeypot Field, which is a cybersecurity mechanism that identifies bots by detecting submissions made to invisible form fields that genuine users don't interact with. If the submission comes with values filled in the hidden fields, the system flags the entry as likely being a spam submission.

Spam Detection has more parameters like these to detect spam submissions and assign appropriate scores. For quick probability recognition, the following colors represent the severity of spam possibilities:
  1. Green: 1% - 20%
  2. Orange: 21% - 70% 
  3. Red: 71% - 100%

How spam detection helps handle records awaiting approval

Previously, records that awaited approval were evaluated manually and then approved, merged, resolved, or deleted accordingly. In addition to these traditional actions, and with the introduction of Spam Detection, administrators can now optionally block IP addresses of records with high spam possibility scores if they want to restrict further submissions from them.

  1. The Block IP button is available, along with the other buttons like Merge, Approve, or Resolve.

  1. Admins can also directly block an IP by using the Block IP button available when hovering over the info icon.

Record submissions from such blocked IPs will be categorized under the new Blocked record category.
Additionally, Zoho's system internally maintains a set of blacklisted IPs based on security assessments. Records submitted from those IPs will be automatically and permanently blocked by the CRM.
Notes
Note: Records under the Blocked category will be deleted in 60 days.

How to enable Spam Detection for your webforms

While setting up a webform, you'll see the Spam Detection section where you can adjust the Spam Possibility Score slider to set the threshold at which records should be flagged for manual review.

A score range of 90% to 100% will be set by default for all webforms as the tolerance level, which the webform owner can change anytime based on their preferences.

NotesNote: Records whose spam possibility scores fall within the set range will be held for approval, along with the relevant percentages and reasons. If, say, the chosen range is 80 to 100%, only those records with spam possibility percentages between 80 and 100 will be listed. Submissions with lower percentages will not be held as spam.

We've revamped the record approval page to provide a better UI experience and make it easier to manage and review spam records. Let's look at the changes in detail.

Revamped record approval page

  1. In modules like Leads, the "Approve Leads" field under Actions has been renamed to "Awaiting Leads". This change extends to other modules as well.
  2. The approval page has been redesigned to make it easier to switch between categories and review all records. This enhancement applies to all webform-supported modules and team modules.

  3. The number of records in each category displayed prevents users from overlooking records that are awaiting approval.
  4. You can also filter these records using the new filters in the left panel on the Awaiting Leads page.
    1. Filter By Source: Filters records based on the source—webform or import.
    2. Filter By Spam Possibilities: Choosing the Webform option will enable this filter to list records based on the spam possibilities.
    3. Filter By Fields: Lists records based on these fields: Created Time and Record Owner.
    4. Filter By IP - Webform: Filters blocked possible spam entries based on whether a given record is blocked manually by a user or automatically by the system. This filter is available only under the Blocked category.
That concludes everything about spam detection in webforms. Feel free to share your thoughts and suggestions in the comments.

Info
Availability 

Editions: All paid editions, including the developer edition (except for the paid trial edition)
DC: All DCs
Release Plan: This feature will be rolled out in phases. {Updated on Jan 30, 2026]

Regards,
Fiona

    • Recent Topics

    • Download All Attached Files

      It would be extremely useful to have "download-all" functionality for downloading files attached to a task, subtask, comment, forum post or hosted in the "Documents" section etc. We've instructed our users to zip multiple files prior to uploading, but of course they forget all the time. Having to download lots of files one-at-a-time off a comment or task wastes a lot of time.

    • Ship via Carrier Not Working Since Commerce Update

      Since the recent update to the Commerce platform, I can no longer use the ship via carrier function. It will take me to the address screen and let me verify them but when I go to save and move tot he next screen it will not do anything. This is happening

    • automations: Can I execute a step on a specific date?

      I have created a form in Zoho forms, and created a contacts list. I have also begun setting up an automation with the intention of sending the form to the contact list on a specific date every month (via email) for the entire year (essentially sending

    • Zoho Expense - The ability to add detail to a Trip during booking

      As an admin, I would like the ability to add more detail to the approved Trips. At present a requestor can add flights, accommodation details and suggest their preferences. It would be great if the exact details of the trip could be added either by the

    • Adding Folders in Android App

      Is it possible to create a new email folder within the Zoho Mail Android app?  Or can this only be done from the desktop version of Zoho Mail? Cheers!

    • Schedule Exports for Regular Project Updates

      Tracking project data often means exporting data at regular intervals. Instead of manually exporting data every time, users can schedule exports for Phases, Tasks, and Tasks in Zoho Projects. These exports can be set to run once, daily, weekly, or monthly

    • Question about custom fields using Pivot Tables.

      I have created a pivot table showing annual revenue of a client and how much payment that client is paying my company. Is there a way using pivot table to add an additional field that subtracts those to fields / shows me a percentage of that difference?

    • Request for Light/Dark Mode

      Would love the ability to switch between Light and Dark mode similar to Zoho CRM. https://help.zoho.com/portal/en/community/topic/introducing-dark-mode-light-mode-a-new-look-for-your-crm

    • Journey Email - Ignored Contacts

      I have a journey setup which simply sends a string of emails over time. For some reason I am getting large amounts of the contacts who enter the first email being ignored and I can't find anywhere in reports or audit logs why these contacts are not

    • Involved account types are not applicable when create journals

      { "journal_date": "2016-01-31", "reference_number": "20160131", "notes": "SimplePay Payroll", "line_items": [{ "account_id": "538624000000035003", "description": "Net Pay", "amount": 26690.09, "debit_or_credit": "credit" }, { "account_id": "538624000000000403", "description": "Gross", "amount": 32000, "debit_or_credit": "debit" }, { "account_id": "538624000000000427", "description": "CPP", "amount": 1295.64, "debit_or_credit": "debit" }, { "account_id": "538624000000000376", "description":

    • Zoho Books - Include Payment Terms as a Custom View filter

      It would be great if you could created a custom view based on Payment Terms. This would be really handy for seeing a list of customers who have credit terms. A workaround is not required. I could do something with a creditor checkbox, but it would be

    • How to update changed purchase account of item in invoice

      I have selected the wrong purchase account for various articles and created invoices. I had to adjust the purchase account in the article afterwards, but the old purchase account is still posted in the transaction-journal of the invoice. To adjust the

    • Help - Zoho CRM notification on mobile (IOS/Android)

      Hello Community! Can I get the IOS/Andoid CRM app to notify me of events, calls, etc. due as I can with MANY other apps?   I am running the free Zoho I would like this to be native to the Zoho CRM app. I do not want to write a sep. mobile app

    • Zoho Books Idea - Include another field in Bank Details for Address

      Hi Books team, Currently use the Description field in the Bank Details to store the bank's address. This works fine but it would be great if you could add another field for Bank Address, so that other notes about the bank account could be stored in the

    • a question about the COQL API v8

      When I specify eight or more values in a WHERE IN clause and execute it, an error occurs. Is there a limit to the number of values that can be specified in a WHERE IN clause? ↓Error select * FROM Vendors WHERE (id in (1, 2, 3, 4, 5, 6, 7, 8, 9)) ↓Success

    • Zoho Books Idea - Bank Details Button on Banking

      Hi Books team, Sometimes I'm asked to share bank details with a customer or a colleague. So I go to the Banking Module, find the correct bank account, click Setting > Edit, then copy and paste the bank details. Wouldn't it be great if there was a button

    • JS SDK 8.0 – TypeError: Cannot read properties of undefined (reading 'getCacheStore') with sample code

      Hello Zoho Support Team, I’m integrating the Zoho CRM JavaScript SDK v8.0 and I’m getting the error below when running your official sample. I tested directly from: https://github.com/zoho/zohocrm-javascript-sdk-8.0/blob/main/samples/create_records_sample/create_records.js

    • Function #55: Convert multiple quotes to single SO using Custom Button

      Hello everyone, and welcome back to our series! In Zoho Books, after a quote is accepted by your customer, it can be converted into a sales order or an invoice. Often, a customer might have multiple quotes, and for easier billing or upon the customer's

    • Time based workflow without edit/action

      Hello I need help solving this problem if possible. We have Deals come into the CRM via Live Transfer which have the field properties: Stage = New Channel = Inbound Some of them don't get answered so we want these to automatically go into our Outbound

    • What's New - August 2025 | Zoho Backstage

      Every month, Zoho Backstage grows with you. These updates aren't just features and fixes, they're about making your workday smoother, your events more impactful, and your attendees happier. We’ve listened, learned, and shaped this release to keep things

    • prevent selling expired items

      Hello. I need to make a constraint on expired batch items not to be sold. Is it possible in Zoho Inventory? if so, then how? Thanks for further help.

    • Product details removed during update from other system

      We maintain our product details in an other system. These details are synchronized with Zoho at the end of each day, through an API. This has worked perfectly sofar. But last Monday, all product codes and some other product data have been wiped during

    • Client Customer

      I purchased a customer user license, but we cannot see the project I added in the customer account. I would like to ask for support on what we should do.

    • Add Ability to Use Zoho Finance Tags

      For Zoho Finance (Books and Inventory), the current actions do not allow us to affect the tags associated with the entities in question (customers, vendors, items, etc.). Please consider adding this functionality into the actions.

    • Embeded Signing doesn't work on Safari Browser

      We have implemented Zoho Sign in our website by using embeded signing, It works perfectly on Chrome. But it fails on Safari, We get stuck on Zoho Sign Page during redirection from Zoho Sign to our website after signing the document, Please let us know

    • Dataprep Webhook Limits and Cannot update column with Dataprep

      I have two problems : 1 - I am using Airflow to trigger my pipeline, and when I tested it, it worked fine a couple of times. However, after that, I received an error: {"code":429,"message":"Request rate limited"}. I didn’t send too many requests — maybe

    • New in Zoho Forms: Google reCAPTCHA v3 for smarter spam protection

      Hello form builders, Spam submissions are one of the biggest challenges when you share your forms online. They not only clutter your data but can also waste valuable time. To help you combat this without making life harder for genuine respondents, we’re

    • Project Management Bulletin: August, 2025

      We’ve touched a grand 19 years since we started pioneering project management solutions with Zoho Projects. What started as a simple one-page interface is now a suite of products with Zoho BugTracker, Zoho Sprints, and our new debut Zoho Projects Plus,

    • Zoho Sign and Zoho Workdrive Integration

      Hello, there. I want to know if it's possible to save a signed document from Zoho Sign in an specific folder for each signer in Zoho Workdrive.  For example: If John Doe signs the document in Zoho Sign I want to save it automatically in a folder named

    • How do you list multiple contacts for a lead?

      My sales team wants to be able to add additional contacts for leads, how do we do that? Is there a different way we should be using the lead / contact functionality? Moderation update (9th September 2025): Our developers have built an extension to achieve

    • Modifying Three Dot Menu Options

      Is there a way to modify the three dot menu options that display in a Report header? They currently display: Show As (List, Calendar, Timeline), Print, Import, Export. I'd like to remove the Show As and Print options, since they aren't applicable for

    • Field Not Updating in FSM Script - Service and Parts module.

      Dear Team, I am reaching out regarding a script I have implemented in Zoho FSM to automate the calculation of the End of Service date based on the End of Sale date in the Service and Parts module. Overview of the script: Fetches the End_of_Sale__C and

    • Zadarma + Zoho CRM Integration – Missed Calls Saved as Contacts Instead of Leads

      Hello everyone, I’m looking for input from anyone with experience using the Zadarma + Zoho CRM integration. Currently, I’m seeing that missed calls are automatically being created as Contacts instead of Leads. From a CRM perspective, this doesn’t make

    • How to update Multiple Users field in Quote Module from Deal Module

      Scenario : Deal Module having Multiple User Field (Presales Engineer) which having more than 1 User and through Deluge Script I need to get that Users Details and need to put into Multiple User Field (Presales Engineer) of Quote Module. Note: Both Module

    • Clone a Module??

      I am giong to repurpose the Vendors module but would like to have a separate but very similar module for another group of contacts called Buyers. I have already repurposed Contacts to Sellers. Is it possible to clone (make a duplicate) module of Vendors

    • How to change the text in WhatsApp Zobot integrated to Zoho Booking?

      I have integrated Zoho Bookings into Zoho SalesIQ, I want to change the text in WhatsApp when creating a booking in Zobot how to change those text?

    • Updating Subform Record from other Form

      Just wanted to ask how to properly approach this. I have 2 forms and would like to trigger an auto update on the subform once record submitted. block below only updates 1 row for each recordRow in input.AV_System { AssetRecord = Site_Asset_Services[SOR_No

    • Zoho Books - Hide Convert to Sales Order if it can't be used.

      Hi Books team, I noticed that it is not possible to convert a Quote to a Sales Order when a Quote is not yet marked as accepted. My idea is to not show the Convert to Sales Order button when it is not possible to use it, or show it in a grey inactive

    • Cross-Data Center Collaboration and / Or allowing users to choose DC

      Dear Zoho Cliq Support Team, We are writing to request a significant enhancement to Zoho Cliq that would greatly benefit our geographically dispersed development team. Current Challenge: Currently, Zoho Cliq automatically routes users to specific data

    • Is it possible to register webhooks in Zoho CRM using API?

      Hello, I am trying to register a webhook in Zoho CRM programmatically (using the API). Specifically, I want to register a webhook that is fired when new Contacts are created in the CRM. I was able to setup a webhook using the UI, by creating a rule that

    • Next Page