Integration guide · SpamKill Transformer

Protect your Zoho CRM form from bots

In short: To stop spam on a Zoho CRM webform, add https://protect.spamkill.dev/ to the webform's Form Location URLs, run its Source Code through the SpamKill Setup Wizard, and paste the protected code on your page. SpamKill checks every submission without a CAPTCHA and real leads still land in Zoho's Leads module. It takes about 10 minutes.

Bots are filling your Zoho CRM webform with fake leads. Copy the form's source code into SpamKill, swap it onto your page, and real leads keep landing in Zoho while the spam stops at the door. One Zoho setting matters, and step 2 shows you where it is.

  • About 10 min
  • 7 steps
  • Copy and paste one snippet

Last verified on Zoho CRM (Leads webform, Canada data center) with the SpamKill Setup Wizard

What changes, and what doesn't

Stays the same
  • Leads still arrive in Zoho CRM's Leads module
  • Your Zoho fields and existing records
  • Your page: only the form code changes
What's added
  • Every submission is checked before it reaches Zoho
  • Bots are stopped without a CAPTCHA
  • Undo it anytime by putting your old form code back
Done this before? Quick setup: one line per step. First time? Start here. Step by step, with a screenshot for every click.

Before you start

Have these ready so nothing stops you halfway.

  • A SpamKill accountNo account yet? Start a free trial.
  • A Zoho CRM login that can open SetupYou need access to Setup › Channels › Webforms.
  • Access to the page your form goes onFor example your WordPress, Webflow or Squarespace editor, or your landing page builder.

Quick setup

For returning users. Each line links to its full step.

  1. In Zoho CRM, open Setup › Channels › Webforms, click New Form, keep Leads, add an Email field and click Next. Step 1
  2. Under Form Location URL, add your page's address and https://protect.spamkill.dev/, then click Save. Step 2
  3. In Publish Options, keep Source Code selected and copy the code. Step 3
  4. In the SpamKill Console, open Setup Wizard, click No to the WordPress question and paste the code. Step 4
  5. Check the email field shows Email, click Generate Protected Code, then Yes, protect my form. Step 5
  6. Paste the protected code where the Zoho code was, publish the page, then click Next. Step 6
  7. Submit [email protected] and expect an error, then submit a real address and check Zoho. Step 7
Step 1 of 7 · In Zoho CRM

Create a webform for Leads

Where: Zoho CRMSetupChannelsWebforms

In Zoho CRM, open Setup and go to Channels › Webforms (or search for Webforms). Click New Form. Name the form, keep Module set to Leads (1) and click Create (2). Drag the fields you need onto the form, including Email (3). Click Next.

The New Form dialog with the form named Contact form, Module set to Leads, and the Create button
1Leads2Create
The webform editor with the Fields list on the left and Company, Last Name and Email on the form
3Email field

You should see: The form's details panel, starting with Form Location URL.

Want it to keep your styling?

Style the form in Zoho's editor before you copy its code. SpamKill keeps most styling, and it's much harder to add back afterwards.

Finished step 1?
0 of 7 steps done
Next: Let SpamKill pass leads to Zoho ↓
Step 2 of 7 · In Zoho CRM

Let SpamKill pass leads to Zoho

Where: Zoho CRMWebformsYour formDetails

In Form Location URL, type the address of the page your form goes on and click Add (1). Then type https://protect.spamkill.dev/ and click Add again (2). Choose what visitors see under Action on Submission. Click Save.

Form Location URL with an Add button, and the Location URL list showing https://protect.spamkill.dev/ and the site's contact page
1Add2protect.spamkill.dev

You should see: Both addresses listed under Location URL.

Why add protect.spamkill.dev?

Zoho only accepts leads sent from the pages listed here. SpamKill passes each checked submission on from protect.spamkill.dev, so without it Zoho shows its thank-you page but quietly drops the lead.

Finished step 2?
0 of 7 steps done
Next: Copy the source code ↓
Step 3 of 7 · In Zoho CRM

Copy the source code

Where: Zoho CRMWebformsPublish Options

After you save, Zoho opens Publish Options. Keep Publishing Format set to Source Code (1). Click the copy icon (2). If nothing is copied, click in the code box, select all the code and copy it.

Publish Options with Publishing Format set to Source Code, the form code in a box and a copy icon beside it
1Source Code2Copy

You should see: The form's code on your clipboard. It starts with <!-- Note :.

Finished step 3?
0 of 7 steps done
Next: Paste it into the Setup Wizard ↓
Step 4 of 7 · In SpamKill

Paste it into the Setup Wizard

Where: SpamKill ConsoleSetup Wizard

In the SpamKill Console, click Setup Wizard in the sidebar. If your site isn't on WordPress, click No under Is your website developed in WordPress?. Paste the Zoho code into the box (1).

The Setup Wizard with Zoho's form code pasted in the box and a note underneath
1Paste your form's code

You should see: Tips under the box, then Please select the email field input.

Is this form already live on your site?

Create a new webform in Zoho and paste its code instead. You can delete the old form once the new one is set up.

Finished step 4?
0 of 7 steps done
Next: Generate the protected code ↓
Step 5 of 7 · In SpamKill

Generate the protected code

Where: SpamKill ConsoleSetup Wizard

SpamKill picks your email field (1). Check it shows Email. Click Generate Protected Code (2). Confirm with Yes, protect my form.

The email field set to Email and the Generate Protected Code button
1Email field2Generate Protected Code
Replace the existing code with this code on your website, above the protected form code

You should see: Replace the existing code with this code on your website, above your protected code.

Finished step 5?
0 of 7 steps done
Next: Swap the code on your page ↓
Step 6 of 7 · On your website

Swap the code on your page

Where: Your website editor

Copy the protected code from the box. Open the page with your Zoho form in your website editor. Delete the Zoho form code and paste the SpamKill code in its place. Save and publish the page. Then click Next in the wizard.

A Contact us page showing the protected Company, Last Name and Email form

You should see: Your page shows the same form as before.

Does your site style the form by field name?

SpamKill renames each field, and the wizard lists the old and new names. Update any CSS or scripts that point at the old names.

Finished step 6?
0 of 7 steps done
Next: Test it twice ↓
Step 7 of 7 · On your live form

Test it twice

Open your page in a private window. Submit the form with [email protected] as the email (1). Then submit it again with an address you can recognise.

SpamKill's That email address doesn't look right page with a Go back to the form button
1Blocked by SpamKill
The new Zoho CRM lead record with the test company and email address
2The test lead's email
On your page

The first try shows That email address doesn't look right.

In Zoho CRM

The second try appears in Leads with the details you entered.

In SpamKill

Back in the wizard, click Both Tests Passed.

You should see: Your Zoho thank-you page after the second try, such as Thank you for submitting your response.

Finished step 7?
0 of 7 steps done

Your Zoho CRM form is protected

  • Bots are stopped before they reach Zoho CRM.
  • Real leads arrive exactly as before, with no extra steps for them.
  • Every block is logged in your SpamKill dashboard.
Open your dashboard

Something not working?

Find what you're seeing.

Zoho shows its thank-you page, but no lead appears

Zoho dropped it because https://protect.spamkill.dev/ isn't in the webform's Form Location URL list. Open the webform in Setup › Channels › Webforms, add the address as in step 2, save, and test again.

A real visitor was told their email doesn't look right

SpamKill checks for missing @ symbols, extra spaces and common typos. The visitor can click Go back to the form, fix the address and send again.

My form looks different

Your site's CSS may target Zoho's old field names. Update it with the new names the wizard listed, or restyle the form in Zoho and repeat steps 3 to 6.

Changed your mind? Undo in under a minute

  1. Open the page in your website editor.
  2. Delete the SpamKill code and paste your original Zoho form code back.
  3. Save and publish the page. Your form is back to how it was.
Did this guide work for you?

Stuck? We'll set it up with you.

Free setup help for every plan. Send us a message and we'll walk through your Zoho CRM form with you.

Get setup help