Introducing spam detection for webforms: An additional layer of protection to keep your Zoho CRM clean and secure

Introducing spam detection for webforms: An additional layer of protection to keep your Zoho CRM clean and secure

Greetings all,

One of the most highly anticipated feature launches—Spam Detection in webforms—has finally arrived!

Webforms are a vital tool for record generation, but they're also vulnerable to submissions from unauthenticated or malicious sources, which can lead to the collection of spam records that clutter CRM systems and reduce data quality. 

Zoho CRM's new spam detection capability provides an additional security layer and minimizes dependencies on the basic options such as captchas and double opt-ins, ultimately improving data quality of webform submissions. Users no longer have to check potential spam records from webforms manually.

Let's dive into how Spam Detection restricts suspected spam records from webforms and helps users keep their CRM clean and organized.

What does spam detection do?

Spam detection offers the following advantages:
  1. Simplifies the manual review of potential spam in webform submissions.
  2. Detects potential spam submissions by identifying invalid or suspicious email addresses and scoring them to indicate spam probability.
  3. Holds these possible spam records for manual approval from users.
  4. Automatically blocks spam records to keep them out of the CRM account.

What happens to webform submissions?

All webform submissions are evaluated against predefined criteria and screened for spam detection. Let's say you've received several webform submissions for the Leads module from your website visitors.

Clean, non-suspicious records that originate from verified IP addresses—and are therefore deemed likely to be genuine and valid—are fed into the Leads module (unless approval has been set for all webform submissions).

In contrast, suspicious submissions are flagged as potentially spam and held back for manual approval in the usual record approval page called, Awaiting Leads (previously known as Approve Leads). These records are assigned a Spam Possibility Score based on the identified suspicious factors. 

The new Record Source column provides details related to the submission's source—for example, the submission's IP address, the webform name, and the URL—when you hover over the info icon. 

The new Spam Possibility column indicates the spam probability for each record as a percentage. You can also view the top reasons behind the scores of the spam record by hovering over the info icon beside it. 


Each reason identified contributes to the score, and the sum is calculated to determine the final Spam Possibility Score for the record. Some of the reasons are listed below:
  1. Submission from bots/crawlers: If a bot or crawler fills and makes a submission via your hosted webform, the Spam Detection layer will automatically identify this malicious submission.
  2. Submission with invalid phone numbers: If a form respondent shares an incorrect phone number, a toll-free number, or a junk contact number, it will be flagged as an invalid phone number.
  3. Submission with invalid email addresses: If the submitted email address originates from a spam source, an unauthorized domain, or a temporary mailbox, it will be flagged as an invalid email address.
We're also introducing an advanced security layer: Honeypot Field, which is a cybersecurity mechanism that identifies bots by detecting submissions made to invisible form fields that genuine users don't interact with. If the submission comes with values filled in the hidden fields, the system flags the entry as likely being a spam submission.

Spam Detection has more parameters like these to detect spam submissions and assign appropriate scores. For quick probability recognition, the following colors represent the severity of spam possibilities:
  1. Green: 1% - 20%
  2. Orange: 21% - 70% 
  3. Red: 71% - 100%

How spam detection helps handle records awaiting approval

Previously, records that awaited approval were evaluated manually and then approved, merged, resolved, or deleted accordingly. In addition to these traditional actions, and with the introduction of Spam Detection, administrators can now optionally block IP addresses of records with high spam possibility scores if they want to restrict further submissions from them.

  1. The Block IP button is available, along with the other buttons like Merge, Approve, or Resolve.

  1. Admins can also directly block an IP by using the Block IP button available when hovering over the info icon.

Record submissions from such blocked IPs will be categorized under the new Blocked record category.
Additionally, Zoho's system internally maintains a set of blacklisted IPs based on security assessments. Records submitted from those IPs will be automatically and permanently blocked by the CRM.
Notes
Note: Records under the Blocked category will be deleted in 60 days.

How to enable Spam Detection for your webforms

While setting up a webform, you'll see the Spam Detection section where you can adjust the Spam Possibility Score slider to set the threshold at which records should be flagged for manual review.

A score range of 90% to 100% will be set by default for all webforms as the tolerance level, which the webform owner can change anytime based on their preferences.

NotesNote: Records whose spam possibility scores fall within the set range will be held for approval, along with the relevant percentages and reasons. If, say, the chosen range is 80 to 100%, only those records with spam possibility percentages between 80 and 100 will be listed. Submissions with lower percentages will not be held as spam.

We've revamped the record approval page to provide a better UI experience and make it easier to manage and review spam records. Let's look at the changes in detail.

Revamped record approval page

  1. In modules like Leads, the "Approve Leads" field under Actions has been renamed to "Awaiting Leads". This change extends to other modules as well.
  2. The approval page has been redesigned to make it easier to switch between categories and review all records. This enhancement applies to all webform-supported modules and team modules.

  3. The number of records in each category displayed prevents users from overlooking records that are awaiting approval.
  4. You can also filter these records using the new filters in the left panel on the Awaiting Leads page.
    1. Filter By Source: Filters records based on the source—webform or import.
    2. Filter By Spam Possibilities: Choosing the Webform option will enable this filter to list records based on the spam possibilities.
    3. Filter By Fields: Lists records based on these fields: Created Time and Record Owner.
    4. Filter By IP - Webform: Filters blocked possible spam entries based on whether a given record is blocked manually by a user or automatically by the system. This filter is available only under the Blocked category.
That concludes everything about spam detection in webforms. Feel free to share your thoughts and suggestions in the comments.

Info
Availability 

Editions: All paid editions, including the developer edition (except for the paid trial edition)
DC: All DCs
Release Plan: This feature will be rolled out in phases. {Updated on Jan 30, 2026]

Regards,
Fiona

    • Recent Topics

    • Main Ticket Page Customization

      We do not love the ticket list page (right after clicking Tickets menu item) would like options to customize it.

    • Agent Collision Missing from Mobile App

      Please add Agent Collision capabilities to the mobile app.

    • Zia Sentiment and Functionality on Mobile

      Please add Zia sentiment and generative responses to the mobile app. It would be nice to see the ticket sentiment and generate a response back to a user using Zia on my iPhone

    • View Account Attachments on iOS

      Please allow us to view account attachments on the mobile iOS app!

    • How do I run a PnL by Sales Person?

      I am trying to run a PnL by sales person but am not seeing the option do so. All I need to know (per salesperson) is revenue, cost of goods, gross profit.

    • View Contracts and Support Plans on Mobile

      We would like to be able to see contracts and support plans from the mobile app on iOS!

    • App like Miro

      Hi all, is there a way to have a interactive whiteboard like in Miro? We want to visualize our processes and workflows in an easy way.

    • Loan repayment Entry

      While receiving loan, i does following steps in My Zoho books. 1. Create "Loan & Advance " Account as Parent Account under Long Term Liabilities. 2. Create another account For Example "Mr. ABC's Loan as Child account under the parent account. Now: In

    • Quotes module send email reverted back into 2022??

      Our Zoho CRM PLUS quotes, sales orders, invoice modules is showing us an email composer from 2022. We cannot send emails and its been a real pain. I tried clicking the new version over there but it doesnt seem to do anything. Any help is welcome. th

    • Workflow Condition - how do check that a date / time value is in the past?

      Hello, I'm got a workflow that runs a function when records reach their 'Effective Date / Time', but sometimes records are created after the 'Effective Date / Time' so I have another workflow that checks for records which needs to be processed immediately.

    • Pre filling SignForm field values by URL field alias's in Zoho Sign

      Hi, Does anyone know if it's possible to pre fill the field values of the SignForm by using field alias's like you can in Zoho forms? To be more specific, I want to be able to change the SignForm URL to include some information like this: Before : https://sign.zoho.eu/signform?form_link=234b4d535f495623920c288fc8538cb9e6db03bbfd44499b63f3e5c48daf78f44bc47f333e2f5072cc1ee74b7332fe18b25c93fab10cb6243278d49c67eacbf30bbe5b6e1cc8c6b2#/

    • How to Split Payout in Zoho Books (Without Using Journal?)

      Hi, I'm trying to properly record payouts in Zoho Books. The issue is that each payout is a combination of sales and expenses (fees). When I try to categorise the payout transaction from the Banking tab, I can only split the transaction using income-type

    • Payment Schedule

      Please add the ability to create a payment schedule. The other options, like retainer invoices or two invoices, do not work for the customer.  We invoice a client and need to be able to show them everything they owe in one invoice, and when each payment

    • Which pricing system do you think would work best for us?

      Imagine we’re selling strictly wholesale. We’d rather not publish unit prices; instead, we quote customers case-by-case. To spur larger orders, we’re considering a transparent discount ladder—say: $0 – $999: 0 % $1,000 – $1,999: 5 % $2,000 – $4,999: 10

    • Pushing to Shipstation from Zoho

      I know there are four triggers in Flow for integration with Shiptation when something happens in Shipstation. What options do I have, if any, for pushing data TO Shipstation from Zoho?

    • Integration with ShipStation

       Any plans to integrate flow with Ship station? My scenario: When a sales order is fully picked order details get pushed to Ship station so shipping label can be created.  Ideally then tracking number would be pushed back to order.  Thanks

    • Can't Remove Payment Gateway

      I am getting the error "Settings cannot be cleared as some of the transactions are still in progress." when trying to remove the PayGate payment gateway which I was unable to get working. I am now using paystack and I want to remove Paygate.

    • Sync specific Zoho Inventory Warehouses to Zoho Commerce

      As said in the title, we would want to only sync stock from one warehouse of Zoho Inventory to the Zoho Commerce item stock. We have a 2 warehouses in different countries and the way that Zoho Commerce works (It takes stock from ALL WAREHOUSES EVERYWHERE

    • Weekly Tips : Automatically clean clutter with Junk cleanup interval

      If you regularly receive many unwanted or spam emails, your Spam folder can quickly fill up and start taking up valuable storage space in your Zoho Mail account. Instead of manually clearing it every few days, you might find it helpful to enable automatic

    • Any solution for getting portal users list in deluge or in widget

      Hi Team, Has anyone able to find the solution to get portal users list in deluge or in zoho creator widgets? Thanks, Payal

    • The Grid is here!

      Hey Zoho Forms Community! 👋 We’re thrilled to announce the launch of a feature that’s been on your wishlist for a while: Grids What is Grids? Grids let you place form fields side by side in multiple columns to create a more concise and organized form

    • GraphQL in new Send Webhooks feature

      Hello, is it possible to use GraphQL apis in the new Send Webhooks feature?

    • # 2 Why do we need a billing system when accounting covers billing?

      In today's evolving financial tech stack, businesses use a mix of tools to manage their day-to-day operations, from invoicing to full-fledged accounting. While accounting platforms typically come with built-in invoicing features, specialized billing systems

    • How to insert an Excel/Zoho Sheet table in a chat?

      Hello, is there a way to paste an excel/zoho sheet table to a conversation without loosing table lines. I tried to paste a piece of a table and all the columns and rows were gone. How to easily paste a table without a need of sending a file? Katarzy

    • Mass Update Application Status

      How to update application statuses of Multiple Applications at once? Is that possible? If not then why please consider adding it It can save hours of manual work Thats the only Option I see

    • Free webinar: Streamlining customer service paperwork with the Zoho Sign extension for Zoho Desk

      Hi there! Wondering how to bridge the gap between digitized customer service and business paperwork? Attend our free webinar to learn how you can do this by connecting Zoho Sign, our digital signature app, with Zoho Desk, our online customer service help

    • Mail Search Not Working

      Hello, Mail search is not working at all. I've tried Chrome and Mozilla. I can try and search for an exact term, or even an email that is 1st in my email list. All search does is sit and spin, or it comes up with no results. I've also tried it on my android

    • Cannot Send Email to a Gmail Account

      Hello, I have a zoho-hosted email account, alex@chirochannelnetwork.com that has trouble sending to gmail accounts.  But not all gmail accounts, only some of them. I've tried to figure this out with clients, and they don't appear to be going into their

    • Unblock ME

      info@pentekykloi.gr Unable to send message;Reason:554 5.1.8 Email Outgoing Blocked. Learn more. I purchase additional storage

    • Cannot Print Landscape with Zoho Sheet

      I am noticing that when using the Zoho Sheet desktop for Mac, that even when selecting landscape as the print option, once you choose "Print", a second system dialog opens that automatically makes the view portrait again, and does not allow printing in

    • Power of Automation : Enhancing custom date field calculations by excluding Weekends and Holidays

      Hello Everyone, A Custom function is a user-written set of code to achieve a specific requirement. Set the required conditions needed as when to trigger using the Workflow rules (be it Tasks / Project) and associate the custom function to it. Requirement:

    • portal.assignUserInProfile - Não esta adicionando

      Estou encontrando problema com este comando portal.assignUserInProfile Não esta incluindo o usuário no portal Alguém pode me dizer o que pode ser thisapp.portal.assignUserInProfile("teste@gmail.com","Customer");

    • CRM emails vs Campaigns

      Please help me understand this. I am having a difficult understanding of "Campaigns" sent through CRM (real emails) or Zoho One (blast "potentially junk" emails) This is what I currently think emails sent via CRM are "real" emails sent through linked real personal email accounts and therefore are more likely to get delivered.  We use this for critical updates for our "Approved " accounts and certain other preferred statuses emails via Campaigns are sent through the Zoho server (like MailChimp, Campaign

    • Reverse proxy

      We have a web application in the creator platform. When I launch a particular DNS, I would like that DNS to redirect to the web page of the application in creator app. Has anyone achieved it and if yes, please share how to do it.

    • Still client need to download .exe?

      Hello, the client for use zoho assist need everytime download .exe file and launch it?

    • Splitting a ticket's entire thread

      Hi, When you split a ticket it only splits the individual reply that you clicked "Split as new ticket" on. Is it not possible to split the entire ticket thread from that point into the new ticket (every reply from the split point forward)? Or is there

    • Editing the text on the Help Center home page

      Is it possible to edit the "Welcome to Help Center" message anywhere? This one: We'd like to be able to tailor it a little more ourselves.

    • WHMCS for Zoho Flow

      Can we use WHMCS for Zoho flow?

    • Online meetings through Calendar Booking form with options

      This is great to see and particularly for those users who don't have Zoho BOOKINGS. The shame of it all though is that it could have been better. Why do we have to set up separate booking forms for each type of meeting and for each online conferencing

    • Agents permission per department

      Hi Team, can I setup permission for each agent what they can do in each department, for example I want account department agents to only have view access to support department tickets and not allowed to assign or reply to clients. I am sure this would

    • Next Page