Search form submission spam or search field submission spam can be an issue that plagues many websites, from WordPress sites to websites built on a custom CMS. Depending on how your on-site search function is built, it can be used to inject malicious scripts and code onto your website, and give access to spammers to have their way with your uniquely created search form pages. These pages are typically no-indexed, but an experienced spammer can use a variety of methods to gain access to your website if plug-ins aren’t up-to-date or if you have other security issues such as weak passwords.

search form submission spam

If you find that your website is showing up in searches similar to the ones in the screenshot of Google search results, you may be in store for a little bit of work, however, with our guide, we wanted to make it easy. Find out how to prevent your website from being used to further these spammers’ SEO agendas so you can identify and prevent spam search form submission on your own website.

What is an On-Site Search Form / Field?

What is the anatomy of a search form or search field, and how can they be spammed to create new pages? First, let’s start with the search form itself, which is a text box that can be used to enter queries that search the database for matches, and logic can be applied for these matches to be more accurate, think of a search form like Amazon’s. The Amazon search field provides a way to internally search through their hundreds of thousands of products to find the exact one a user will want to purchase, which is the intention of these search forms, to more accurately find the content a user wants. Auto-fill and other features can make this process much easier, but depending on how a website is created, these search forms can be very insecure.

See the screenshot below of a website that has been afflicted by this very issue of search form spam:

search field submission spam

How Does Search Form Submission Spam Work?

Generally, when a user searches on the website, it makes a request to the database to return pages that match the keyword(s) entered into the search form. When spammers do this, they will oftentimes enter keywords related to their website, such as the ones in the first screenshot around “enhancement pills”. A website will then generate a new page with a unique URL with the spam text and some other related text that mentions “no results found”. Now, this is where it gets interesting because there is now a uniquely generated page with the keywords the spammer wants, and they can pass this link onto the search engine and a search engine can index the newly created search page. Oftentimes, these individually created search pages are set to noindex (meta robots) or will be blocked in the robots.txt file, but if they are posting links to spammy sites, comment sections, and other places, these links can be found and crawled by Google and other search engines, which is how I can find these (through third part links data providers such as One thing to consider is to perform regular backlink monitoring to ensure that these links (and others) are not indexed by Google.

Although, these individually created pages aren’t even the worst thing that can happen with these search forms. When search result pages are not static, each request will require the site to generate this page which can put a strain on the server’s power, and a LARGE number of these searches through automated systems can cause servers to crash (DDoS attack). Additionally, these search forms can also be used for web application attacks, where they can attempt to use PHP vulnerabilities for remote code injection. These two issues are the worst-case scenarios, but rarely the case with secure, up-to-date websites.

How to Stop Search Form Submission Spam.

There are a few options, and these greatly depend on your development framework, but this guide on how to stop search form submission spam will cover how to fix this for a WordPress site.

  1. Remove or disable search on your website. This may be the “nuclear” option, but if you are experiencing an insurmountable amount of spam and do not have the development resources to properly solve the issue, disabling the search form to prevent the search field submission spam can work.**
  2. Add noindex and nofollow meta robots tags to the search results pages in the template itself. You can also add the search query string to your robots.txt file to disallow bots from accessing them as an extra layer of defense against spam, although the danger of DDoS and hacking through PHP vulnerabilities is not completely gone.**
  3. Use a plug-in such as CleanTalk. Honestly, this is the easiest option, even if you do not have the technical know-how to update your search templates, this will help you across the board to prevent spam.
  4. Replace your search form with something more secure such as Relevanssi.

** These two options (#1 & #2) will work for sites other than WordPress sites, but may not help fix the entire issue that exists with potential DDoS or PHP vulnerabilities.

For more information, here are some helpful resources:


长津湖 外交部回应拜登重申不支持台独 国际人士热议中共十九届六中全会 大连一密接者擅自点外卖聚餐被调查 大连一密接者擅自点外卖聚餐被调查 国际人士热议中共十九届六中全会 国际人士热议中共十九届六中全会 尚气与十环传奇 国际人士热议中共十九届六中全会 花木兰 大连现超级传播者26人在同一传播链 尚气与十环传奇 五个扑水的少年 24岁救人牺牲消防员获批为烈士 国际人士热议中共十九届六中全会 意大利错失直接晋级世界杯资格 突围 大连现超级传播者26人在同一传播链 北京冬奥火炬宣传片获金花环奖 国足最新出线概率0.08% 印度首都准备封城 林丹世界排名被正式移除 国足战澳大利亚大名单:4归化在列 200斤鳄鱼被吓后待水里溺死 星辰大海 林丹世界排名被正式移除 周冠宇成为中国首位F1车手 峰爆 北京冬奥火炬宣传片获金花环奖 中国医生 国足战澳大利亚大名单:4归化在列 甄嬛传 周冠宇成为中国首位F1车手 大连现超级传播者26人在同一传播链 十九届六中全会公报发布 你好李焕英 北京冬奥火炬宣传片获金花环奖 周冠宇成为中国首位F1车手 北京冬奥火炬宣传片获金花环奖 扫黑风暴 中美元首是否达成新共识?中方回应 男子写80页PPT拯救爱情却离婚 美人鱼 浦发银行回应近3亿存款莫名被质押 五个扑水的少年 中美元首会谈重点内容 安娜贝尔 意大利错失直接晋级世界杯资格 中美元首是否达成新共识?中方回应 男子体检血中抽出2升油浆 意大利错失直接晋级世界杯资格 周冠宇成为中国首位F1车手 林丹世界排名被正式移除 国足战澳大利亚大名单:4归化在列 中国共产党第三个历史决议全文发布 国足最新出线概率0.08% 灵媒 大连现超级传播者26人在同一传播链 长津湖 两个女人 罗永浩吐槽苹果文案没文化 罗永浩吐槽苹果文案没文化 浦发银行回应近3亿存款莫名被质押 男子体检血中抽出2升油浆 房价上涨城市创七年新低 拐点来了? 浦发银行回应近3亿存款莫名被质押 周冠宇成为中国首位F1车手 扫黑风暴 大连现超级传播者26人在同一传播链 中国医生 鱿鱼游戏
刚察县| 富蕴县| 原阳县| 宁波市| 汤阴县| 太保市| 隆昌县| 临潭县| 杨浦区| 锦屏县| 连云港市| 兰州市| 临湘市| 合作市| 曲周县| 沧州市| 康平县| 嘉黎县| 临沭县| 金湖县| 威远县| 宣化县| 剑阁县| 天祝|