Integration guide · SpamKill Transformer

Protect your Mailchimp form from bots

In short: To stop spam on a Mailchimp embedded form, run its code through the SpamKill Setup Wizard, delete Mailchimp's mc-validate.js and window.fnames scripts from the result, and paste it on your page. SpamKill checks every signup without a CAPTCHA and real subscribers still reach your audience; afterwards, visitors see Mailchimp's own confirmation page. It takes about 10 minutes.

Bots are signing fake addresses up to your Mailchimp audience. Protect your embedded signup form with SpamKill and real subscribers keep landing in Mailchimp. One limitation to know first: you delete two Mailchimp scripts from the code, and after signing up, visitors see Mailchimp's own confirmation page instead of a message under the form.

  • About 10 min
  • 6 steps
  • Copy and paste one snippet

Last verified on Mailchimp Free (embedded form) with the SpamKill Setup Wizard

What changes, and what doesn't

Stays the same
  • Subscribers still arrive in your Mailchimp audience
  • Your audience and existing contacts
  • Your form's fields and look
What's added
  • Every signup is checked before it reaches Mailchimp
  • Visitors see Mailchimp's confirmation page, in a new tab, instead of a message under the form
  • Undo it anytime by putting your old form code back
Done this before? Quick setup: one line per step. First time? Start here. Step by step, with a screenshot for every click.

Before you start

Have these ready so nothing stops you halfway.

  • A SpamKill accountNo account yet? Start a free trial.
  • A Mailchimp embedded formIn Mailchimp, under Forms, with the form type Embedded form.
  • A way to edit your page's HTMLYou'll delete two script tags from the code before you paste it, so use an HTML or code block in your site editor.

Quick setup

For returning users. Each line links to its full step.

  1. In Mailchimp, open Forms, click Edit on your embedded form, then Continue and Copy Code. Step 1
  2. In the SpamKill Console, open Setup Wizard, click No to the WordPress question and paste the code. Step 2
  3. Click Generate Protected Code, check the email field is EMAIL, then click Yes, protect my form. Step 3
  4. Copy the protected code into a text editor and delete the mc-validate.js script tag and the window.fnames script. Step 4
  5. Paste the edited code where the Mailchimp code was, publish the page, then click Next. Step 5
  6. Submit [email protected] and expect an error, then submit a real address and check your audience. Step 6
Step 1 of 6 · In Mailchimp

Copy your embedded form code

Where: MailchimpForms

In Mailchimp, click Forms in the sidebar (1). Click Edit next to your embedded form (2). Click Continue. On Your form is ready!, click Copy Code (3).

The Forms page in Mailchimp listing an embedded form named SpamKill test - embedded
1Forms2Your embedded form
Your form is ready! with the Embedded Form Code box and a Copy Code button
3Copy Code

You should see: Your form's code on your clipboard. It starts with <div id="mc_embed_shell">.

Finished step 1?
0 of 6 steps done
Next: Paste it into the Setup Wizard ↓
Step 2 of 6 · In SpamKill

Paste it into the Setup Wizard

Where: SpamKill ConsoleSetup Wizard

In the SpamKill Console, click Setup Wizard in the sidebar. If your site isn't on WordPress, click No under Is your website developed in WordPress?. Paste the Mailchimp code into the box (1).

The Setup Wizard with Mailchimp's form code pasted in the box
1Paste your form's code

You should see: Tips under the box, then Please select the email field input showing EMAIL.

Is this form already live on your site?

Create a new embedded form in Mailchimp and paste its code instead. You can delete the old form once the new one is set up.

Finished step 2?
0 of 6 steps done
Next: Generate the protected code ↓
Step 3 of 6 · In SpamKill

Generate the protected code

Where: SpamKill ConsoleSetup Wizard

Click Generate Protected Code. SpamKill asks you to check the email field: it should be EMAIL (1). Click Yes, protect my form (2).

The Check the email field dialog with EMAIL selected and a Yes, protect my form button
1EMAIL2Yes, protect my form
Replace the existing code with this code on your website, above the protected form code

You should see: Replace the existing code with this code on your website, above your protected code.

Finished step 3?
0 of 6 steps done
Next: Delete Mailchimp's two scripts ↓
Step 4 of 6 · In a text editor

Delete Mailchimp's two scripts

Copy the protected code and paste it into a text editor. Find the tag <script type="text/javascript" src="//s3.amazonaws.com/downloads.mailchimp.com/js/mc-validate.js"></script> and delete it. Right after it is a long block starting <script type="text/javascript">(function($) {window.fnames and ending </script>. Delete that whole block too. Leave every other script in place.

You should see: Searching the code for mc-validate and window.fnames finds nothing.

Why delete them?

Mailchimp's validation script sends the form in the background. SpamKill needs the browser to submit it normally, so with the script on the page the signup is lost and nobody sees an error.

Finished step 4?
0 of 6 steps done
Next: Swap the code on your page ↓
Step 5 of 6 · On your website

Swap the code on your page

Where: Your website editor

Open the page with your Mailchimp form in your website editor. Delete the Mailchimp form code and paste your edited SpamKill code in its place. Save and publish the page. Then click Next in the wizard.

A Newsletter page showing the protected Mailchimp Subscribe form with an Email Address field

You should see: Your page shows the same signup form as before.

Does your site style the form by field name?

SpamKill renames the email field, and the wizard lists the old and new names. Update any CSS or scripts that point at the old name.

Finished step 5?
0 of 6 steps done
Next: Test it twice ↓
Step 6 of 6 · On your live form

Test it twice

Open your page in a private window. Submit the form with [email protected] (1). Then submit it again with an address you can recognise. Mailchimp opens its confirmation page in a new tab (2).

SpamKill's That email address doesn't look right page with a Go back to the form button
1Blocked by SpamKill
Mailchimp's page saying Your subscription to our list has been confirmed, with a Continue to website button
2Mailchimp's confirmation page
The new contact's profile in Mailchimp with the test email address
3Your test contact
On your page

The first try shows That email address doesn't look right.

In Mailchimp

The second try appears under Audience as Subscribed, source Embed Form.

In SpamKill

Back in the wizard, click Both Tests Passed.

You should see: Your subscription to our list has been confirmed. after the second try.

Finished step 6?
0 of 6 steps done

Your Mailchimp form is protected

  • Bots are stopped before they reach Mailchimp.
  • Real leads arrive exactly as before, with no extra steps for them.
  • Every block is logged in your SpamKill dashboard.
Open your dashboard

Something not working?

Find what you're seeing.

The form submits, but no contact appears in Mailchimp

One of Mailchimp's scripts is still on the page. Check the live page's code for mc-validate and window.fnames, delete what you find as in step 4, and test again.

A real visitor was told their email doesn't look right

SpamKill checks for missing @ symbols, extra spaces and common typos. The visitor can click Go back to the form, fix the address and send again.

There's no thank-you message under the form

That's expected. Without Mailchimp's script, the confirmation shows on Mailchimp's own page, which opens in a new tab.

Changed your mind? Undo in under a minute

  1. Open the page in your website editor.
  2. Delete the SpamKill code and paste your original Mailchimp form code back.
  3. Save and publish the page. Your form is back to how it was.
Did this guide work for you?

Stuck? We'll set it up with you.

Free setup help for every plan. Send us a message and we'll walk through your Mailchimp form with you.

Get setup help