# NoMoreSpam: Settings, Tips and Troubleshooting > Feature reference, advanced configuration, best practices, and answers to common spam protection problems. --- This page is part of the [NoMoreSpam guide](/docs/nomorespam). Start there for what the extension does, installation and the frequently asked questions. ## Features reference ### General Switches the entire module on or off. When disabled, no hidden fields are injected into any form and no spam checks run - all form submissions pass through normally. - **When to use it**: Disable temporarily if you suspect false positives are blocking real customers, while you investigate. - Config path: `moogento_nomorespam/general/enable` --- ### Protect: Specific Sections Individual on/off toggles for each protected form. Each toggle controls whether hidden fields are injected into that form and whether its submissions are checked. - **Contact form** (`moogento_nomorespam/protect_sections/contact_form`) - The standard Magento contact page. - **Product reviews** (`moogento_nomorespam/protect_sections/product_reviews`) - The review submission form on product pages. - **Newsletter** (`moogento_nomorespam/protect_sections/newsletter`) - The newsletter subscription form. - **Frontend: User registration** (`moogento_nomorespam/protect_sections/sign_up`) - The customer account creation form. - **Frontend: Login** (`moogento_nomorespam/protect_sections/login`) - The customer login form. - **Frontend: Forgotten password** (`moogento_nomorespam/protect_sections/forgotten_password`) - The password reset request form. - **Admin: Login** and **Admin: Forgotten password** - Displayed but require NoMoreSpam Pro. See the [NoMoreSpam Pro (upgrade)](/docs/nomorespam#nomorespam-pro-upgrade-nomorespam-pro-upgrade) section. Turn on only the forms you need. Unnecessary protection adds a tiny overhead to every page load. --- ### Protect: Custom Forms The Custom Forms section is a Pro feature. On the free version this panel shows an upgrade prompt and is not configurable. Upgrade to NoMoreSpam Pro (see [NoMoreSpam Pro (upgrade)](/docs/nomorespam#nomorespam-pro-upgrade-nomorespam-pro-upgrade)) to protect third-party or custom-built forms beyond the standard Magento set. --- ### Risk: Scoring Six toggles that control which signals are used in spam detection. Each counts independently - any one failing signal is enough to block a submission. | Signal | Config path | What it catches | |---|---|---| | Contact form: Links in name? | `moogento_nomorespam/behaviours/contact_enable_link_title` | URLs/link syntax in the sender name field | | Contact form: Links in message? | `moogento_nomorespam/behaviours/contact_enable_link_content` | URLs/link syntax in the message body | | Product review: Links in title? | `moogento_nomorespam/behaviours/review_enable_link_title` | URLs/link syntax in the review headline | | Product review: Links in review? | `moogento_nomorespam/behaviours/review_enable_link_content` | URLs/link syntax in the review body | | Product review: Ratings not set? | `moogento_nomorespam/behaviours/review_enable_rating` | Reviews submitted without a star rating | | Forms submitted too fast? | `moogento_nomorespam/behaviours/check_too_fast` | Submissions arriving under the timing threshold | Spam link patterns checked: `a href`, `[url`, `http`, `://`, `[link`, `www.` --- ## Advanced configuration ### Hidden field rotation (automatic) NoMoreSpam auto-generates the names for its hidden fields on first use and stores them in `core_config_data` under `moogento_nomorespam/secret/`. You never need to set these manually. The paths are: - `moogento_nomorespam/secret/field_1` - SHA-256 hash field name - `moogento_nomorespam/secret/field_2` - Honeypot field name (must stay empty on submit) - `moogento_nomorespam/secret/nms_id` - Protection container div ID - `moogento_nomorespam/secret/nms_toofast` - Timestamp field name - `moogento_nomorespam/secret/nms_form_action` - Original form action storage #### Notes - If you ever need to force regeneration (e.g. after a suspected key leak), delete the `moogento_nomorespam/secret/*` rows from `core_config_data` and run `php bin/magento cache:clean config`. New keys are generated on next page load. - Do not manually set values in these paths - the generator always produces cryptographically secure tokens. --- ### NoMoreSpam Pro co-existence When NoMoreSpam Pro is installed alongside the free version, the free module defers entirely to Pro. The **Enable** field in General config displays a notice ("NoMoreSpam Pro is installed - this non-Pro version has been disabled") and the free module's spam checks return `false` for every submission. There is no double-processing. To revert to the free version, uninstall Pro (`composer remove moogento/m2-nomorespampro`) and clear cache. --- ## Tips & best practices - Start with the contact form and product reviews enabled, plus all scoring signals on. Monitor the spam log for a week before expanding to login and registration. - Turn off **Contact form: Links in message?** if your customers regularly include support URLs or order tracking links in messages - it's the most common source of false positives. - Enable **Product review: Ratings not set?** only if your review form marks the star rating as required - otherwise genuine no-rating reviews will be blocked. - Keep logging off in production; enable it only for diagnostics and then switch it back off. Each blocked request writes to disk. - If you need to protect admin login or custom forms, or want IP allowlisting, configurable thresholds, and payment fraud protection, see the [NoMoreSpam Pro (upgrade)](/docs/nomorespam#nomorespam-pro-upgrade-nomorespam-pro-upgrade) section. - After any config change, run `php bin/magento cache:clean` to ensure the updated settings are read. - **Pro:** Before going live with Pro, open the Protection Level panel at the top of the NoMoreSpam Pro config page and confirm every row shows a green tick for the protections you intend to use. - **Pro:** Run `php bin/magento moogento:nomorespampro:status --format=json` after any significant config change to confirm `overall.status` is healthy before traffic hits the new settings. - **Pro:** After installing Pro for the first time, open the Store Security panel (within the Protection Status section at the top of Stores > Configuration > Moogento > NoMoreSpam Pro) and work through any action-needed rows before going live. Pay special attention to HTTPS, admin 2FA, and dangerous upload extensions - these form the security baseline. - **Pro:** Use the Admin 2FA page bulk actions to send setup emails to multiple unenrolled admins at once, or to revoke trusted devices store-wide after a security incident. - **Pro:** Enable **Remember This Device** under Admin Two-Factor Authentication to reduce daily 2FA friction for your team - keep **Trust Duration (Days)** at 14 or lower for shared-device environments. --- ## Troubleshooting ### Hidden fields not appearing in forms Customers submit spam despite having NoMoreSpam enabled. - **Cause:** The module is enabled in config but the hidden fields never reached the page HTML, so the spam check always fails open. - **Check:** View the source of your contact or review page and search for the hidden field container div. If it's absent, check whether NoMoreSpam Pro is also installed - Pro suppresses free-version field injection. - **Resolution:** Confirm `moogento_nomorespam/general/enable = 1` in Stores > Configuration > Moogento > NoMoreSpam > General. If Pro is installed and you want the free version to run instead, disable or uninstall Pro and clear cache. --- ### Real customers are being blocked on the contact form Legitimate contact form submissions are rejected with a generic error. - **Cause:** A scoring signal is too aggressive for your customers - most often **Links in message?** when customers paste URLs, or **Forms submitted too fast?** when the page pre-populates fields. - **Check:** Enable logging (`moogento_nomorespam/general/enable_log = Yes`) and inspect `var/log/moogento_nomorespam.log` to see which check is triggering. - **Resolution:** In Stores > Configuration > Moogento > NoMoreSpam > Risk: Scoring, switch off the offending signal. If the speed check is the cause, note that the threshold is 1 second and cannot be adjusted in the free version - NoMoreSpam Pro exposes a configurable threshold. --- ### Spam is getting through despite protection being on Bot submissions are still reaching your inbox or review queue. - **Cause:** The bot is slow enough to pass the speed check, is not including link patterns, and fills all fields including the honeypot - or it targets a form that isn't in the protected set. - **Check:** Enable logging and inspect `var/log/moogento_nomorespam.log` to confirm which form type is leaking through. Also inspect the page source to verify hidden fields are present on that form. - **Resolution:** Enable every available scoring signal in Risk: Scoring. For persistent evasion or to protect admin forms and custom forms, upgrade to NoMoreSpam Pro (see [NoMoreSpam Pro (upgrade)](/docs/nomorespam#nomorespam-pro-upgrade-nomorespam-pro-upgrade)), which adds IP blocking, custom selector support, and more detection layers. --- ### Config cache holds stale secret keys Hidden fields appear in the HTML but validation always fails. - **Cause:** The secret key values in `core_config_data` and the fields rendered on the page are out of sync after a cache flush or manual edit. - **Check:** Look for JS console errors on the form page - a JavaScript load failure would prevent field injection entirely. Also check that the `moogento_nomorespam/secret/` rows exist in `core_config_data`. - **Resolution:** Run `php bin/magento cache:clean config`. On the next page load, the helper reads the stored keys and regenerates them if missing. If the problem persists, delete the `moogento_nomorespam/secret/*` rows from `core_config_data` to force a full key regeneration. --- ### Legitimate customers blocked at checkout (Pro) Payment attempts are declined with no clear reason. - **Cause:** Risk threshold may be too low, a high-weight signal is firing on real shoppers, or attack-velocity scoring placed a short-lived automatic block on the customer's IP after rapid retry attempts. - **Check:** Open Moogento > NoMoreSpam Pro > Payments and locate the blocked attempt. The risk_details column shows which signals contributed. Check the Blocklist grid for a `velocity_sticky_block` entry - those expire automatically within 15 minutes. - **Resolution:** Lower the offending signal weight in Risk: Scoring rather than raising the global threshold. Add the customer's IP or email to the allowlist for immediate unblocking. --- ### Customer reports a server error and cannot reach the payment step (Pro) A shopper says they get a server error at checkout and cannot select or enter a payment method, often after retrying over a day or two. - **Cause:** Payment method protection runs pre-auth validation before the payment reaches the gateway. When a real shopper scores above the risk threshold, or attack-velocity scoring has placed a short-lived automatic block on their IP after repeated retries, the payment step is stopped and can surface to the shopper as a generic server error rather than a clear decline message. - **Check:** Open Moogento > NoMoreSpam Pro > Payments and find the STATUS_BLOCKED rows for that checkout session, matching on time, email, or IP. The risk score and risk_details columns show which signals fired. Check the Blocklist grid for a `velocity_sticky_block` entry on the shopper's IP (those expire on their own within 15 minutes), and confirm protection is active under Advanced: Payment Method Protection. - **Resolution:** For an immediate fix for a known-good customer, add their IP or email under Stores > Configuration > Moogento > NoMoreSpam Pro > Protect: Allowlists and choose a Bypass Mode (Permissive skips all checks). To reduce false positives more broadly, lower the weight of the signal that is firing in Risk: Scoring, or raise the Global Risk: Threshold toward 95, or enable the reCAPTCHA v3 challenge fallback for borderline scores instead of hard blocking. To confirm the cause quickly, temporarily disable pre-auth validation, retry the order, then turn it back on. --- ### Integration or form post returns "Request rejected" (Pro) A bespoke API client, ERP connector or custom form gets HTTP 400 or 403 with "Request rejected". - **Cause:** The hardening level is Strict and the request contains a Magento template directive (`{{...}}`), including encoded or full-width variants. - **Check:** Open `var/log/moogento_nomorespampro.log` and find the `Blocked ... request carrying a template directive in field ` line for that path and IP. - **Resolution:** Stop the client sending `{{...}}` text if you can. Lowering the level to Standard stops the check for every store, so do it only as a temporary step. For a single client that must send the text, ask your developer to add its path prefix to the `exemptPaths` list in the module's `di.xml`. Use this only as an emergency measure. --- ### Malware scanner flags Helper/Moo.php - Cause: Your host's malware scanner (often Imunify360 on cPanel hosting) heuristically flags the encoded license-check files that ship inside every paid Moogento extension. The files are genuine and unchanged - the encoding protects the license check from tampering. - Resolution: Add the files to the scanner's ignore list so the warnings stop, and restore any file the scanner already quarantined. Both steps, plus how to verify the files are byte-for-byte what we shipped, are covered in the [license file protection guide](../magento-guides/moogento-license-file-protection.md). --- ## Other pages in this guide - [NoMoreSpam overview, installation and FAQs](/docs/nomorespam) - [NoMoreSpam Pro: Payment, Admin and Store Security](/docs/nomorespam-pro-features)