NoMoreSpam: Settings, Tips and Troubleshooting

This page is part of the NoMoreSpam guide. Start there for what the extension does, installation and the frequently asked questions.

#Features reference

#General

Switches the entire module on or off. When disabled, no hidden fields are injected into any form and no spam checks run - all form submissions pass through normally.

• When to use it: Disable temporarily if you suspect false positives are blocking real customers, while you investigate.
• Config path: moogento_nomorespam/general/enable

#Protect: Specific Sections

Individual on/off toggles for each protected form. Each toggle controls whether hidden fields are injected into that form and whether its submissions are checked.

• Contact form (moogento_nomorespam/protect_sections/contact_form) - The standard Magento contact page.
• Product reviews (moogento_nomorespam/protect_sections/product_reviews) - The review submission form on product pages.
• Newsletter (moogento_nomorespam/protect_sections/newsletter) - The newsletter subscription form.
• Frontend: User registration (moogento_nomorespam/protect_sections/sign_up) - The customer account creation form.
• Frontend: Login (moogento_nomorespam/protect_sections/login) - The customer login form.
• Frontend: Forgotten password (moogento_nomorespam/protect_sections/forgotten_password) - The password reset request form.
• Admin: Login and Admin: Forgotten password - Displayed but require NoMoreSpam Pro. See the NoMoreSpam Pro (upgrade) section.

Turn on only the forms you need. Unnecessary protection adds a tiny overhead to every page load.

#Protect: Custom Forms

The Custom Forms section is a Pro feature. On the free version this panel shows an upgrade prompt and is not configurable. Upgrade to NoMoreSpam Pro (see NoMoreSpam Pro (upgrade)) to protect third-party or custom-built forms beyond the standard Magento set.

#Risk: Scoring

Six toggles that control which signals are used in spam detection. Each counts independently - any one failing signal is enough to block a submission.

Spam link patterns checked: a href, [url, http, ://, [link, www.

#Advanced configuration

#Hidden field rotation (automatic)

NoMoreSpam auto-generates the names for its hidden fields on first use and stores them in core_config_data under moogento_nomorespam/secret/. You never need to set these manually. The paths are:

• moogento_nomorespam/secret/field_1 - SHA-256 hash field name
• moogento_nomorespam/secret/field_2 - Honeypot field name (must stay empty on submit)
• moogento_nomorespam/secret/nms_id - Protection container div ID
• moogento_nomorespam/secret/nms_toofast - Timestamp field name
• moogento_nomorespam/secret/nms_form_action - Original form action storage

#Notes

• If you ever need to force regeneration (e.g. after a suspected key leak), delete the moogento_nomorespam/secret/* rows from core_config_data and run php bin/magento cache:clean config. New keys are generated on next page load.
• Do not manually set values in these paths - the generator always produces cryptographically secure tokens.

#NoMoreSpam Pro co-existence

When NoMoreSpam Pro is installed alongside the free version, the free module defers entirely to Pro. The Enable field in General config displays a notice ("NoMoreSpam Pro is installed - this non-Pro version has been disabled") and the free module's spam checks return false for every submission. There is no double-processing.

To revert to the free version, uninstall Pro (composer remove moogento/m2-nomorespampro) and clear cache.

#Tips & best practices

• Start with the contact form and product reviews enabled, plus all scoring signals on. Monitor the spam log for a week before expanding to login and registration.
• Turn off Contact form: Links in message? if your customers regularly include support URLs or order tracking links in messages - it's the most common source of false positives.
• Enable Product review: Ratings not set? only if your review form marks the star rating as required - otherwise genuine no-rating reviews will be blocked.
• Keep logging off in production; enable it only for diagnostics and then switch it back off. Each blocked request writes to disk.
• If you need to protect admin login or custom forms, or want IP allowlisting, configurable thresholds, and payment fraud protection, see the NoMoreSpam Pro (upgrade) section.
• After any config change, run php bin/magento cache:clean to ensure the updated settings are read.
• Pro: Before going live with Pro, open the Protection Level panel at the top of the NoMoreSpam Pro config page and confirm every row shows a green tick for the protections you intend to use.
• Pro: Run php bin/magento moogento:nomorespampro:status --format=json after any significant config change to confirm overall.status is healthy before traffic hits the new settings.
• Pro: After installing Pro for the first time, open the Store Security panel (within the Protection Status section at the top of Stores > Configuration > Moogento > NoMoreSpam Pro) and work through any action-needed rows before going live. Pay special attention to HTTPS, admin 2FA, and dangerous upload extensions - these form the security baseline.
• Pro: Use the Admin 2FA page bulk actions to send setup emails to multiple unenrolled admins at once, or to revoke trusted devices store-wide after a security incident.
• Pro: Enable Remember This Device under Admin Two-Factor Authentication to reduce daily 2FA friction for your team - keep Trust Duration (Days) at 14 or lower for shared-device environments.

#Troubleshooting

#Hidden fields not appearing in forms

Customers submit spam despite having NoMoreSpam enabled.

• Cause: The module is enabled in config but the hidden fields never reached the page HTML, so the spam check always fails open.
• Check: View the source of your contact or review page and search for the hidden field container div. If it's absent, check whether NoMoreSpam Pro is also installed - Pro suppresses free-version field injection.
• Resolution: Confirm moogento_nomorespam/general/enable = 1 in Stores > Configuration > Moogento > NoMoreSpam > General. If Pro is installed and you want the free version to run instead, disable or uninstall Pro and clear cache.

#Real customers are being blocked on the contact form

Legitimate contact form submissions are rejected with a generic error.

• Cause: A scoring signal is too aggressive for your customers - most often Links in message? when customers paste URLs, or Forms submitted too fast? when the page pre-populates fields.
• Check: Enable logging (moogento_nomorespam/general/enable_log = Yes) and inspect var/log/moogento_nomorespam.log to see which check is triggering.
• Resolution: In Stores > Configuration > Moogento > NoMoreSpam > Risk: Scoring, switch off the offending signal. If the speed check is the cause, note that the threshold is 1 second and cannot be adjusted in the free version - NoMoreSpam Pro exposes a configurable threshold.

#Spam is getting through despite protection being on

Bot submissions are still reaching your inbox or review queue.

• Cause: The bot is slow enough to pass the speed check, is not including link patterns, and fills all fields including the honeypot - or it targets a form that isn't in the protected set.
• Check: Enable logging and inspect var/log/moogento_nomorespam.log to confirm which form type is leaking through. Also inspect the page source to verify hidden fields are present on that form.
• Resolution: Enable every available scoring signal in Risk: Scoring. For persistent evasion or to protect admin forms and custom forms, upgrade to NoMoreSpam Pro (see NoMoreSpam Pro (upgrade)), which adds IP blocking, custom selector support, and more detection layers.

#Config cache holds stale secret keys

Hidden fields appear in the HTML but validation always fails.

• Cause: The secret key values in core_config_data and the fields rendered on the page are out of sync after a cache flush or manual edit.
• Check: Look for JS console errors on the form page - a JavaScript load failure would prevent field injection entirely. Also check that the moogento_nomorespam/secret/ rows exist in core_config_data.
• Resolution: Run php bin/magento cache:clean config. On the next page load, the helper reads the stored keys and regenerates them if missing. If the problem persists, delete the moogento_nomorespam/secret/* rows from core_config_data to force a full key regeneration.

#Legitimate customers blocked at checkout (Pro)

Payment attempts are declined with no clear reason.

• Cause: Risk threshold may be too low, a high-weight signal is firing on real shoppers, or attack-velocity scoring placed a short-lived automatic block on the customer's IP after rapid retry attempts.
• Check: Open Moogento > NoMoreSpam Pro > Payments and locate the blocked attempt. The risk_details column shows which signals contributed. Check the Blocklist grid for a velocity_sticky_block entry - those expire automatically within 15 minutes.
• Resolution: Lower the offending signal weight in Risk: Scoring rather than raising the global threshold. Add the customer's IP or email to the allowlist for immediate unblocking.

#Customer reports a server error and cannot reach the payment step (Pro)

A shopper says they get a server error at checkout and cannot select or enter a payment method, often after retrying over a day or two.

• Cause: Payment method protection runs pre-auth validation before the payment reaches the gateway. When a real shopper scores above the risk threshold, or attack-velocity scoring has placed a short-lived automatic block on their IP after repeated retries, the payment step is stopped and can surface to the shopper as a generic server error rather than a clear decline message.
• Check: Open Moogento > NoMoreSpam Pro > Payments and find the STATUS_BLOCKED rows for that checkout session, matching on time, email, or IP. The risk score and risk_details columns show which signals fired. Check the Blocklist grid for a velocity_sticky_block entry on the shopper's IP (those expire on their own within 15 minutes), and confirm protection is active under Advanced: Payment Method Protection.
• Resolution: For an immediate fix for a known-good customer, add their IP or email under Stores > Configuration > Moogento > NoMoreSpam Pro > Protect: Allowlists and choose a Bypass Mode (Permissive skips all checks). To reduce false positives more broadly, lower the weight of the signal that is firing in Risk: Scoring, or raise the Global Risk: Threshold toward 95, or enable the reCAPTCHA v3 challenge fallback for borderline scores instead of hard blocking. To confirm the cause quickly, temporarily disable pre-auth validation, retry the order, then turn it back on.

#Integration or form post returns "Request rejected" (Pro)

A bespoke API client, ERP connector or custom form gets HTTP 400 or 403 with "Request rejected".

• Cause: The hardening level is Strict and the request contains a Magento template directive ({{...}}), including encoded or full-width variants.
• Check: Open var/log/moogento_nomorespampro.log and find the Blocked ... request carrying a template directive in field <path> line for that path and IP.
• Resolution: Stop the client sending {{...}} text if you can. Lowering the level to Standard stops the check for every store, so do it only as a temporary step. For a single client that must send the text, ask your developer to add its path prefix to the exemptPaths list in the module's di.xml. Use this only as an emergency measure.

#Malware scanner flags Helper/Moo.php

• Cause: Your host's malware scanner (often Imunify360 on cPanel hosting) heuristically flags the encoded license-check files that ship inside every paid Moogento extension. The files are genuine and unchanged - the encoding protects the license check from tampering.
• Resolution: Add the files to the scanner's ignore list so the warnings stop, and restore any file the scanner already quarantined. Both steps, plus how to verify the files are byte-for-byte what we shipped, are covered in the license file protection guide.

#Other pages in this guide

• NoMoreSpam overview, installation and FAQs
• NoMoreSpam Pro: Payment, Admin and Store Security