Development of Spam Protection Module for 1C-Bitrix

Introduction

The feedback form starts receiving 200–300 spam submissions per day. Managers stop trusting form data and begin to miss real leads. The site loses conversion, and processing junk takes hours of work—a reality in e-commerce. Bitrix offers built-in Google reCAPTCHA v2 through the form component, but bots have long learned to bypass it using captcha-solving services. High-load forms require multilayered protection. We have been developing modules for Bitrix for over 5 years and have implemented more than 50 spam protection projects, so we know which method combinations are effective under different loads. Contact us for a free audit of your current protection—we'll identify weak spots and select a configuration.

Why a Single Method Doesn't Work

Each spam protection method has weaknesses:

Effective protection is multilayered, where each method covers the weaknesses of others. A module built on honeypot + rate limit is about 10 times more effective in terms of price/quality than a single captcha. According to a Spamhaus report, more than 85% of spam is generated by bots.

Module Architecture

Layer 1 — Honeypot + Timer

A hidden field named website (bots will like it) and a field form_fill_time. If website is filled or form_fill_time < 3 seconds, the submission is likely from a bot with 99% probability.

Layer 2 — Behavioral Analysis

JavaScript writes mouse events and keystrokes into a hidden field. On submission, the server checks: was there real mouse movement, was there reasonable typing speed? Bots mimicking humans spend resources on this and rarely use it for mass attacks.

Layer 3 — Rate Limiting by IP and Fingerprint

No more than N submissions from one IP in M minutes. Fingerprint is built from User-Agent, Accept-Language, Accept-Encoding — not from IP. Rules are stored in myvendor_spam_rate:

CREATE TABLE myvendor_spam_rate ( fingerprint VARCHAR(64) NOT NULL, form_id VARCHAR(100), hits INT DEFAULT 1, first_hit TIMESTAMP DEFAULT NOW(), last_hit TIMESTAMP DEFAULT NOW(), blocked BOOLEAN DEFAULT false, PRIMARY KEY (fingerprint, form_id) ); 

Layer 4 — Reputation Databases

Check sender IP via AbuseIPDB API or Spamhaus. If score is above threshold, block or increase verification difficulty. Results are cached in myvendor_spam_ip_cache with a TTL of 24 hours to avoid hitting the external API on every request.

Layer 5 — ML Text Classifier

For forms with text fields (message, comment) — content analysis. A simple naive Bayes classifier trained on historical spam/non-spam data of the specific site. Stored in myvendor_spam_model, retrained by an agent once a week.

More about honeypot can be read on Wikipedia, and about reputation databases in AbuseIPDB documentation.

Integrating with Bitrix Forms

Intercept forms via the OnWebFormResult_Add event (module form):

AddEventHandler('form', 'OnWebFormResult_Add', function(&$arFields, &$arValues) { $verdict = \MyVendor\Spam\Analyzer::analyze( ip: $_SERVER['REMOTE_ADDR'], fingerprint: \MyVendor\Spam\Fingerprint::get(), formId: $arFields['FORM_ID'], fields: $arValues, fillTime: (int)($_POST['form_fill_time'] ?? 0) ); if ($verdict->isSpam()) { $arFields['COMMENTS'] .= "\n[SPAM: {$verdict->getReason()}]"; $arFields['STATUS'] = 'N'; } }); 

Important: spam submissions are not deleted but marked. This allows periodic review of marked submissions and correction of false positives—data for improving the classifier.

Protecting Registration and Cart

Spam bots attack not only contact forms but also the registration form (creating junk accounts) and the cart (testing stolen cards through small payments). The module extends to these points: for registration—same honeypot + rate limit; for cart—detecting patterns (many small orders from different cards in a short time).

How We Test the Module

Before launch, we run the module on your site's historical data (if spam logs exist) or on synthetic traffic simulating bots. We measure the percentage of false positives and missed spam submissions. We adjust thresholds to minimize both metrics. After deployment, the module continues to learn from new data.

Development Process

1. Threat analysis: study types of spam attacks on your project.
2. Architecture design: choose a combination of layers based on load.
3. Implementation: write module code considering your forms.
4. Testing: verify on historical data and synthetic data.
5. Deployment and monitoring: install on the production server, track metrics.

What's Included in the Work

• Technical specification with method selection for your load.
• Development and configuration of the module for specific forms (feedback, registration, cart).
• Configuration and support documentation.
• Administrator training (1–2 hours online).
• Free support for 1 month after launch.

Development Timelines

Before ordering a complex solution, assess the scale of the problem: sometimes honeypot + rate limit is enough, and it will solve 95% of spam in 1 week. For an accurate assessment of your project, contact us—we will analyze your current situation for free and offer an optimal configuration. Get a consultation today.