Integration guide · SpamKill Transformer

Protect your Salesforce form from bots

In short: To stop spam on a Salesforce Web-to-Lead form, generate the form's HTML in Setup, run it through the SpamKill Setup Wizard, and paste the protected code on your page. SpamKill checks every submission without a CAPTCHA, and real leads still land in Salesforce with Lead Source "Web". It takes about 10 minutes, with no code to edit by hand.

Bots are filling your Salesforce Web-to-Lead form with fake leads. Protect the form's HTML with SpamKill and real leads keep landing in Salesforce while the spam stops at the door, with no CAPTCHA for your visitors to solve.

  • About 10 min
  • 6 steps
  • Copy and paste one snippet

Last verified on Salesforce Web-to-Lead (Developer Edition) with the SpamKill Setup Wizard

What changes, and what doesn't

Stays the same
  • Leads still arrive in Salesforce, with Lead Source "Web"
  • Your Return URL: visitors land on your thank-you page
  • Your page: only the form code changes
What's added
  • Every submission is checked before it reaches Salesforce
  • No reCAPTCHA box for visitors to tick
  • Undo it anytime by putting your old form code back
Done this before? Quick setup: one line per step. First time? Start here. Step by step, with a screenshot for every click.

Before you start

Have these ready so nothing stops you halfway.

  • A SpamKill accountNo account yet? Start a free trial.
  • A Salesforce user that can open SetupYou need access to Setup › Web-to-Lead.
  • Access to the page your form goes onFor example your WordPress, Webflow or Squarespace editor, or your landing page builder.

Quick setup

For returning users. Each line links to its full step.

  1. In Salesforce Setup, type Web-to-Lead in Quick Find, open it and click Create Web-to-Lead Form. Step 1
  2. Pick your fields, enter your thank-you page as the Return URL, untick Include reCAPTCHA in HTML, click Generate and copy all the code. Step 2
  3. In the SpamKill Console, open Setup Wizard, click No to the WordPress question and paste the code. Step 3
  4. Click Generate Protected Code, check the email field is email, then click Yes, protect my form. Step 4
  5. Paste the protected code where the Salesforce form code was, publish the page, then click Next. Step 5
  6. Submit [email protected] and expect an error, then submit a fresh address and check the lead. Step 6
Step 1 of 6 · In Salesforce

Open Web-to-Lead

Where: SalesforceSetupWeb-to-Lead

In Salesforce, open Setup. Type Web-to-Lead in the Quick Find box and click Web-to-Lead (1). Under Web-to-Lead Settings, click Create Web-to-Lead Form (2).

Salesforce Setup with Web-to-Lead found in Quick Find, and the Web-to-Lead Settings box with a Create Web-to-Lead Form button
1Web-to-Lead2Create Web-to-Lead Form

You should see: Create a Web-to-Lead Form, with Available Fields and Selected Fields lists.

Is Web-to-Lead Enabled unticked?

Ask your Salesforce admin to turn it on under Web-to-Lead Settings.

Finished step 1?
0 of 6 steps done
Next: Generate the form code ↓
Step 2 of 6 · In Salesforce

Generate the form code

Where: SalesforceSetupWeb-to-LeadCreate a Web-to-Lead Form

Move the fields you want into Selected Fields. Enter the page visitors should see after they submit as the Return URL (1). Untick Include reCAPTCHA in HTML (2): SpamKill checks submissions without a CAPTCHA. Click Generate. Copy all of the HTML in the box (3), then click Finished.

The Create a Web-to-Lead Form page with a Return URL filled in and Include reCAPTCHA in HTML unticked
1Your thank-you page2Untick reCAPTCHA
The generated HTML: a form that posts to webto.salesforce.com with hidden oid and retURL fields
3Plain HTML form

You should see: The form code on your clipboard. It includes <form action="https://webto.salesforce.com/.

Already have a Web-to-Lead form on your site?

You can use its code. If you no longer have it, generate the form again with the same fields and Return URL.

Finished step 2?
0 of 6 steps done
Next: Paste it into the Setup Wizard ↓
Step 3 of 6 · In SpamKill

Paste it into the Setup Wizard

Where: SpamKill ConsoleSetup Wizard

In the SpamKill Console, click Setup Wizard in the sidebar. If your site isn't on WordPress, click No under Is your website developed in WordPress?. Paste the Salesforce code into the box (1).

The Setup Wizard with Salesforce's Web-to-Lead code pasted in the box
1Paste your form's code

You should see: Tips under the box, then Please select the email field input showing email.

Finished step 3?
0 of 6 steps done
Next: Generate the protected code ↓
Step 4 of 6 · In SpamKill

Generate the protected code

Where: SpamKill ConsoleSetup Wizard

Click Generate Protected Code. SpamKill asks you to check the email field: it should be email (1). Click Yes, protect my form (2).

The Check the email field dialog with email selected and a Yes, protect my form button
1email2Yes, protect my form
Replace the existing code with this code on your website, above the protected form code, which now posts to protect.spamkill.dev

You should see: Replace the existing code with this code on your website, above your protected code.

Finished step 4?
0 of 6 steps done
Next: Swap the code on your page ↓
Step 5 of 6 · On your website

Swap the code on your page

Where: Your website editor

Copy the protected code from the box. Open the page with your Salesforce form in your website editor. Delete the Web-to-Lead form code and paste the SpamKill code in its place. Save and publish the page. Then click Next in the wizard.

A Contact us page showing the protected Web-to-Lead form with name, email, company, city, country and state fields

You should see: Your page shows the same form as before.

Does your site style the form by field name?

SpamKill renames each field, and the wizard lists the old and new names. Update any CSS or scripts that point at the old names.

Finished step 5?
0 of 6 steps done
Next: Test it twice ↓
Step 6 of 6 · On your live form

Test it twice

Open your page in a private window. Submit the form with [email protected] (1). Then submit it again with a name and an email address you haven't used in a test before. Salesforce sends you to your Return URL page (2).

SpamKill's That email address doesn't look right page with a Go back to the form button
1Blocked by SpamKill
A thank-you page saying Thanks! We'll be in touch.
2Your Return URL page
The new lead in Salesforce with company and email filled in, Lead Source Web, and an address of Vancouver, British Columbia, Canada
3Lead Source: Web4Address from the form
On your page

The first try shows That email address doesn't look right.

In Salesforce

The second try appears in Leads, with Lead Source Web.

In SpamKill

Back in the wizard, click Both Tests Passed.

You should see: Your Return URL page after the second try.

Finished step 6?
0 of 6 steps done

Your Salesforce form is protected

  • Bots are stopped before they reach Salesforce.
  • Real leads arrive exactly as before, with no extra steps for them.
  • Every block is logged in your SpamKill dashboard.
Open your dashboard

Something not working?

Find what you're seeing.

Real leads aren't showing up in Salesforce

Check the live page has the protected code: its form sends to protect.spamkill.dev. If you changed the form in Salesforce, generate its code again and repeat steps 3 to 5. Testing again? Use an email address you haven't tested with before.

A real visitor was told their email doesn't look right

SpamKill checks for missing @ symbols, extra spaces and common typos. The visitor can click Go back to the form, fix the address and send again.

Does Salesforce require reCAPTCHA in your org?

We tested with Require reCAPTCHA Verification turned off under Web-to-Lead Settings, and the form generated without reCAPTCHA. If your org requires it, ask your Salesforce admin before you switch.

Changed your mind? Undo in under a minute

  1. Open the page in your website editor.
  2. Delete the SpamKill code and paste your original Web-to-Lead form code back.
  3. Save and publish the page. Your form is back to how it was.
Did this guide work for you?

Stuck? We'll set it up with you.

Free setup help for every plan. Send us a message and we'll walk through your Salesforce form with you.

Get setup help