Introducing spam detection for webforms: An additional layer of protection to keep your Zoho CRM clean and secure

Introducing spam detection for webforms: An additional layer of protection to keep your Zoho CRM clean and secure

Greetings all,

One of the most highly anticipated feature launches—Spam Detection in webforms—has finally arrived!

Webforms are a vital tool for record generation, but they're also vulnerable to submissions from unauthenticated or malicious sources, which can lead to the collection of spam records that clutter CRM systems and reduce data quality. 

Zoho CRM's new spam detection capability provides an additional security layer and minimizes dependencies on the basic options such as captchas and double opt-ins, ultimately improving data quality of webform submissions. Users no longer have to check potential spam records from webforms manually.

Let's dive into how Spam Detection restricts suspected spam records from webforms and helps users keep their CRM clean and organized.

What does spam detection do?

Spam detection offers the following advantages:
  1. Simplifies the manual review of potential spam in webform submissions.
  2. Detects potential spam submissions by identifying invalid or suspicious email addresses and scoring them to indicate spam probability.
  3. Holds these possible spam records for manual approval from users.
  4. Automatically blocks spam records to keep them out of the CRM account.

What happens to webform submissions?

All webform submissions are evaluated against predefined criteria and screened for spam detection. Let's say you've received several webform submissions for the Leads module from your website visitors.

Clean, non-suspicious records that originate from verified IP addresses—and are therefore deemed likely to be genuine and valid—are fed into the Leads module (unless approval has been set for all webform submissions).

In contrast, suspicious submissions are flagged as potentially spam and held back for manual approval in the usual record approval page called, Awaiting Leads (previously known as Approve Leads). These records are assigned a Spam Possibility Score based on the identified suspicious factors. 

The new Record Source column provides details related to the submission's source—for example, the submission's IP address, the webform name, and the URL—when you hover over the info icon. 

The new Spam Possibility column indicates the spam probability for each record as a percentage. You can also view the top reasons behind the scores of the spam record by hovering over the info icon beside it. 


Each reason identified contributes to the score, and the sum is calculated to determine the final Spam Possibility Score for the record. Some of the reasons are listed below:
  1. Submission from bots/crawlers: If a bot or crawler fills and makes a submission via your hosted webform, the Spam Detection layer will automatically identify this malicious submission.
  2. Submission with invalid phone numbers: If a form respondent shares an incorrect phone number, a toll-free number, or a junk contact number, it will be flagged as an invalid phone number.
  3. Submission with invalid email addresses: If the submitted email address originates from a spam source, an unauthorized domain, or a temporary mailbox, it will be flagged as an invalid email address.
We're also introducing an advanced security layer: Honeypot Field, which is a cybersecurity mechanism that identifies bots by detecting submissions made to invisible form fields that genuine users don't interact with. If the submission comes with values filled in the hidden fields, the system flags the entry as likely being a spam submission.

Spam Detection has more parameters like these to detect spam submissions and assign appropriate scores. For quick probability recognition, the following colors represent the severity of spam possibilities:
  1. Green: 1% - 20%
  2. Orange: 21% - 70% 
  3. Red: 71% - 100%

How spam detection helps handle records awaiting approval

Previously, records that awaited approval were evaluated manually and then approved, merged, resolved, or deleted accordingly. In addition to these traditional actions, and with the introduction of Spam Detection, administrators can now optionally block IP addresses of records with high spam possibility scores if they want to restrict further submissions from them.

  1. The Block IP button is available, along with the other buttons like Merge, Approve, or Resolve.

  1. Admins can also directly block an IP by using the Block IP button available when hovering over the info icon.

Record submissions from such blocked IPs will be categorized under the new Blocked record category.
Additionally, Zoho's system internally maintains a set of blacklisted IPs based on security assessments. Records submitted from those IPs will be automatically and permanently blocked by the CRM.
Notes
Note: Records under the Blocked category will be deleted in 60 days.

How to enable Spam Detection for your webforms

While setting up a webform, you'll see the Spam Detection section where you can adjust the Spam Possibility Score slider to set the threshold at which records should be flagged for manual review.

A score range of 90% to 100% will be set by default for all webforms as the tolerance level, which the webform owner can change anytime based on their preferences.

NotesNote: Records whose spam possibility scores fall within the set range will be held for approval, along with the relevant percentages and reasons. If, say, the chosen range is 80 to 100%, only those records with spam possibility percentages between 80 and 100 will be listed. Submissions with lower percentages will not be held as spam.

We've revamped the record approval page to provide a better UI experience and make it easier to manage and review spam records. Let's look at the changes in detail.

Revamped record approval page

  1. In modules like Leads, the "Approve Leads" field under Actions has been renamed to "Awaiting Leads". This change extends to other modules as well.
  2. The approval page has been redesigned to make it easier to switch between categories and review all records. This enhancement applies to all webform-supported modules and team modules.

  3. The number of records in each category displayed prevents users from overlooking records that are awaiting approval.
  4. You can also filter these records using the new filters in the left panel on the Awaiting Leads page.
    1. Filter By Source: Filters records based on the source—webform or import.
    2. Filter By Spam Possibilities: Choosing the Webform option will enable this filter to list records based on the spam possibilities.
    3. Filter By Fields: Lists records based on these fields: Created Time and Record Owner.
    4. Filter By IP - Webform: Filters blocked possible spam entries based on whether a given record is blocked manually by a user or automatically by the system. This filter is available only under the Blocked category.
That concludes everything about spam detection in webforms. Feel free to share your thoughts and suggestions in the comments.

Info
Availability 

Editions: All paid editions, including the developer edition (except for the paid trial edition)
DC: All DCs
Release Plan: This feature will be rolled out in phases. {Updated on Jan 30, 2026]

Regards,
Fiona


      Zoho Campaigns Resources


        • Desk Community Learning Series


        • Digest


        • Functions


        • Meetups


        • Kbase


        • Resources


        • Glossary


        • Desk Marketplace


        • MVP Corner


        • Word of the Day


        • Ask the Experts


          Zoho CRM Plus Resources

            Zoho Books Resources


              Zoho Subscriptions Resources

                Zoho Projects Resources


                  Zoho Sprints Resources


                    Zoho Orchestly Resources


                      Zoho Creator Resources


                        Zoho WorkDrive Resources



                          Zoho CRM Resources

                          • CRM Community Learning Series

                            CRM Community Learning Series


                          • Tips

                            Tips

                          • Functions

                            Functions

                          • Meetups

                            Meetups

                          • Kbase

                            Kbase

                          • Resources

                            Resources

                          • Digest

                            Digest

                          • CRM Marketplace

                            CRM Marketplace

                          • MVP Corner

                            MVP Corner




                            Zoho Writer Writer

                            Get Started. Write Away!

                            Writer is a powerful online word processor, designed for collaborative work.

                              Zoho CRM コンテンツ



                                ご検討中の方

                                  • Recent Topics

                                  • Attention API Users: Upcoming Support for Renaming System Fields

                                    Hello all! We are excited to announce an upcoming enhancement in Zoho CRM: support for renaming system-defined fields! Current Behavior Currently, system-defined fields returned by the GET - Fields Metadata API have display_label and field_label properties

                                  • Zia's ability to generate and improve content extended to Desk mobile app (iOS and Android)

                                    In support, agents will have to understand customers' pain points completely to provide empathetic personalized solutions and a positive experience. However, at times, agents might find it challenging to comprehend the customer issues and connect with

                                  • BANK FEED - MAYBANK , provider from YODLEE IS NOT WORKING

                                    As per topic, the provider YODLEE is not working for the BANK FEED. It have been reported since 2023 Q3, and second report on 2023 Q4. now almost end of 2024 Q1, and coming to 2024 Q2. Malaysia Bank Maybank is NOT working. can anyone check on this issue?

                                  • Zoho Sign product updates - Q3 2025

                                    Hello everyone! Q3 was all about AI. Here's the list of features and enhancements that have gone live, along with a list of what we have in pipeline for the last quarter: AI-powered agreement management Sending documents and authenticating recipients

                                  • Zoho sites header

                                    Good day, Im stuck with this situation. I choose a template for my website creation. I have tweaked every instance of the visual editor, regarding the header, I have created created customize fonts presets... I have followed every single step. and my

                                  • Kaizen #152 - Client Script Support for the new Canvas Record Forms

                                    Hello everyone! Have you ever wanted to trigger actions on click of a canvas button, icon, or text mandatory forms in Create/Edit and Clone Pages? Have you ever wanted to control how elements behave on the new Canvas Record Forms? This can be achieved

                                  • DNS set up

                                    I want to create an email with my company domain. When I tried to add new record with cloudflare it didn't work. The DNS record can't be manually added. I followed the instruction but still can't add it. Could you help?

                                  • Pocket from Mozilla is closing shop. Don’t lose your favorites . Move them to Zoho Mail Bookmarks now! 📥🔖

                                    The end of Pocket shouldn't mean the end of your important links and content. Easily import them into Zoho Mail's Bookmarks and continue right where you left off. You can bring over your entire Saves, Collections, and tags just the way they are. Bookmarks

                                  • General suggestions

                                    Hello, I've picked this forum as it is at the top of the list! :) First suggestion: A general forum for issues and comments that are not specific to a particular Zoho application. Second suggestion: Put a link on the home page to "Zoho Identity Access Manager" The first suggestion came about because I didn't know where to post the second! ;) Regards Mark

                                  • Can't upload attachments.

                                    I can't upload attachment in Zoho Mail.

                                  • Need Guidance on SPF Flattening for Zoho Mail Configuration

                                    Hi everyone, I'm hoping to get some advice on optimizing my SPF record for a Zoho Mail setup. I use Zoho Mail along with several other Zoho services, and as a result, my current SPF record has grown to include multiple include mechanisms. My Cloudflare

                                  • How use

                                    Good morning sir I tried Zoho Mail

                                  • Zoho Mail Desktop App Not Loading + Can’t Manage Multiple Accounts

                                    Hi everyone, I’ve been having ongoing issues with the Zoho Mail desktop app for the past few weeks. The app starts to load but gives up midway and never actually opens — there’s no error message, it just stops loading. The main reason I use the desktop

                                  • Error when sending emails from Zoho

                                    Hello, When trying to send an email from Zoho CRM I keep getting the below error: javax.mail.AuthenticationFailedException: 535 5.7.139 Authentication unsuccessful, the user credentials were incorrect. Any support on this will be much appreciated. Thanks,

                                  • Not all emails from outlook365 migrated to my new zoho account

                                    I recently setup a new email address hosted by zoho. I migrated all my folders and email from my Outlook365 account to my new zoho account, but not all my emails migrated. Looks like only the past 12 months, or so, made the move. How do I get the rest

                                  • Max numbr of IMAP Accounts in Zoho Mail?

                                    In Zoho mail, you can manage the inboxes of other accounts using IMAP (and POP, actually) https://www.zoho.com/mail/help/external-imap-accounts.html Is there a max to the number of inboxes we can add?

                                  • Formula Fields Trouble

                                    Hi,  I can't get even a simple formula field to work and must be doing something dumb. This formula: If(Len(Trim(${Quotes.Subject}))=0,1,2) Gives the error: You used the wrong type of data in an argument. Check what you entered between the parentheses of your functions to make sure you put the right kind of data in the right place. This formula: Len(Trim(${Quotes.Subject}))=0 Gives the error: Syntax Error. Check the examples for any functions you're using to see if you formatted them correctly. Make

                                  • OPTED FOR STORAGE BY DESCRIPTIVE MISGUIDANCE

                                    We've opened a domain with three mail ids and payment has also been processed now the bill raised is for single use ID with additional storage capacity. Kindly request you to modify the purchase.

                                  • How can I add a new organization on Zoho Campaign

                                    I want to create a new organization with my Zoho Campaign

                                  • www.abc.com is working but abc.com is not

                                    I have my domain in godaddy. I have created a website using zoho sites and now I want to publish it and I tried doing it. Mapped the domain www.abc.com, abc.com. In godaddy changed the CNAME values. A, @ was parked and updated with zoho's IP address.

                                  • Split my account

                                    Hello, I recently bought an email service for a friend. But, looks like I used my personal account to buy the plan. Please split the account so that the email service stays in a different account than my personal account.

                                  • Have Mail Lite, wish to add/purchase 2nd domain and use email

                                    Hello, I have recently created two new businesses. I have successfully used Zoho to create a domain for one business and have set up two email addresses / users on that domain. I am trying to figure out how to create a second domain, just like I did the

                                  • Need support in setting up the company email and few other setups

                                    Need support in setting up the company email and few other setups

                                  • This mobile number has been marked spam.

                                    Dear zoho team, I am very happy to use zoho,because it india 🇮🇳 own app, but when we login into zoho account we facing some issue, please solve below issue ASAP. Add your mobile number As an added security measure for Accounts, you need to verify and

                                  • Add an external email to the allowed list

                                    I need to allow an external email to raise a ticket on Manage Engine ServiceDesk Plus. The external email is a outside of our domain and is not a domain user. The email address that needs to be allowed to raise a ticket request is noreply@formsatack.com.

                                  • Display name & account type change

                                    I made a mistake and subscribed with an individual account instead of business, how can I change the account type and enter the details of the business. The other question, if I can't, then I want the display name of our email to be 'Business name' instead

                                  • Request to change display name in Zoho mail

                                    Hello Zoho Mail Support, I am experiencing an issue with changing the display name on my Zoho Mail account. My email address is: info@witchcraftproduction.rs . I have already updated the display name in Settings > Mail Accounts, where it now shows as

                                  • Outbound IP address SPAM problem.

                                    Hello Zoho Support, We noticed that one of your outbound IP addresses (136.143.188.12), which delivers our domain’s mail, is currently listed on the UCEProtect blacklist. Because of this, our messages are sometimes flagged as spam by recipient servers.

                                  • Answer Bot and Personalized Questions

                                    Hi there, I have the same problem using the SalesIQ Answer Bot and the Zoho Desk Answer Bot (which really need different names, to be honest, in order to avoid confusion...) Customers that visit our website ask questions in the form of "What do you do?"

                                  • Forwarding

                                    How can I forward my Zoho account to my gmail account? Noël

                                  • Add a Way to Duplicate Cards in the Same Canvas (Retain All Settings)

                                    Dear Zoho SalesIQ Team, We would like to request a new feature in Zoho SalesIQ: the ability to duplicate an existing card within the same canvas while retaining all of its information and settings, including conditions, configurations, and display preferences.

                                  • Zoho Mail CC and BCC not working

                                    Zoho Mail CC and BCC not working. I have tried multiple combinations amongst my domain aliases but emails sent as CC or BCC never arrive, not even to Spam. I have checked that the DNS is set up correctly in Cloudflare and have even received a DMARC report

                                  • Zoho Autoplay Issue

                                    Currently, we run our graphics on a playlist with youtube videos interspersed in our office -- however, when we go to update the playlist (since last Thursday at around 8-9am EST) it no longer saves the autoplay function.  We have tried making a new account, manually saving with cntrl+s, making a new show, etc but nothing seems to work.  Even with our old program, we can't change it off of autoplay for ones that were created in the past. Another issue is that if we change a slide transition to anything

                                  • Adding hyperlinks in CRM emails time automatically

                                    It may just be me, but when I am writing an email to a lead, I find inserting a hyperlink very time consuming. Granted, I can use templates but there are a ton of scenarios where I might want to put a link in to an website that wouldnt require me to go though the effort of creating a template.  Ideally, the crm would identify that I that a string of text is a URL and insert the hyperlink automatically, just like microsoft outlook or gmail. Has anyone else had this same experience and found a way

                                  • Enhance "Applications Usage" with Date Filters, Historical Analytics & App-Level Breakdown

                                    Hello Zoho Creator Team, We are writing to request a critical enhancement to the Applications Usage section to improve our ability to monitor, analyze, and manage our platform consumption over time. While the current view of today’s usage is helpful for

                                  • External File Share - Allow delete

                                    Hi Team, when I share an external link and give it edit rights the external user can add but not delete files and folders. what am i doing wrong?

                                  • How to notify all members on any updates to zoho crm?

                                    Hi, I am using the free version of zoho CRM and currently seeing this will work for our company. We are a small company and wanted to be more informed about all the changes in zoho. 1. How do I s et notifications that go to the team for any and all changes

                                  • How to change the format for phone numbers?

                                    Mobile phone numbers are currently formatted (###) ###-####.  How can I change this to a more appropriate forms for Australia being either #### ### ### or (#)### ### ###?

                                  • Unattended Access on Android without Play Store

                                    I'm testing Zoho Assist for remote config and maintenance of our IoT devices. The devices are running Android 8.1 and do NOT have Google Play Store installed, nor can it be installed. I've been able to install Zoho Assist on the devices and load the enrollment

                                  • Is it possible to embed Zoho Bookmarks in the Cliq sidebar?

                                    Is there any way that each Zoho user can access their bookmarks (that live in https://bookmarks.zoho.eu/ which is technically a part of Zoho Mail) directly within Cliq? As a widget, or an item in the sidebar? My team does not use Mail, it uses Cliq all

                                  • Next Page