How can I prevent and manage spam in Zendesk?

<h2 id="h_01HG0BYFEVJWRKE0SC7N033433">Question</h2><p>My account is receiving spam tickets. How can I prevent further spam and manage the existing tickets?</p><h2 id="h_01HG0BYFEVJTW26DYG4RQ9R43Q">Answer</h2><p>If your account receives spam tickets, first identify where the spam comes from and apply the appropriate prevention method. You can then use views, automations, the API, or third-party apps to manage or remove the spam tickets.</p><div class="note">
<span class="notetitle">Note:</span> Zendesk is unable to delete data on your behalf by the <a href="https://support.zendesk.com/hc/en-us/articles/4408886656410-Data-Recovery-Policy" target="_blank" rel="noopener noreferrer">Data Recovery Policy</a>.</div><div style="margin-bottom: 20px; text-align: right;">
<button id="master-toggle" class="btn fw-semibold text-dark" data-action="expand" style="background-color: #DEF991; border: none; outline: none; border-radius: 7px; padding: 10px 20px; font-size: 15px; transition: background-color 0.2s ease;" onmouseover="this.style.backgroundColor='#cbef6d'" onmouseout="this.style.backgroundColor='#DEF991'">
Expand all tabs
</button>
</div>
<script>
document.addEventListener('DOMContentLoaded', function () {
const toggleBtn = document.getElementById('master-toggle');

toggleBtn.addEventListener('click', function () {
const action = this.getAttribute('data-action');
const headers = document.querySelectorAll('.accordion');

headers.forEach(header => {
const isActive = header.classList.contains('active');
const panel = header.nextElementSibling; // Grabs the corresponding .panel container

if (action === 'expand' && !isActive) {
// Open it by simulating a standard click
header.click();
} else if (action === 'collapse' && isActive) {
// Close it by simulating a standard click
header.click();
}
});

// Flip button text and states
if (action === 'expand') {
this.setAttribute('data-action', 'collapse');
this.textContent = 'Collapse all tabs';
} else {
this.setAttribute('data-action', 'expand');
this.textContent = 'Expand all tabs';
}
});
});
</script><div class="accordion"><h3 id="h_4fdf311c-d1ca-417d-9be0-0caf48ec4e90">Identify the source of the spam</h3></div><div class="panel">
<p>Open a spam ticket and check the ticket events. If the ticket was submitted through a channel other than the web form, such as X or email, the channel details appear in the events.</p>
<p>This step helps you choose the appropriate prevention method.</p>
</div><div class="accordion"><h3 id="h_01M0FVXAH3ET67R5MTVWE06BXA">Prevent spam from contact forms</h3></div><div class="panel">
<p>CAPTCHA is turned on by default to help prevent spam attacks on your web form. To add another layer of protection, require end users to register and verify their email address before they can access the web form.</p>
<p>If your contact form forwards submissions to Zendesk by email, don't use the <strong>Mark as spam</strong> option on those tickets. This can cause Zendesk to treat your external form as spam or place your email domain on a blocklist. Use bulk delete or another cleanup method instead.</p>
</div><div class="accordion"><h3 id="h_01M0FW5P2D0ANVMRQ4Y17M8V32">Prevent spam submitted through web services</h3></div><div class="panel">
<p>To protect the request and uploads APIs, require authentication for API requests:</p>
<ol>
<li data-list-item-id="e0067c22a994161e61cd6b95e04609e62">In <strong>Admin Center</strong>, click <strong>People</strong> in the sidebar</li>
<li data-list-item-id="ea7ea81d156ab2154f5cc28ae12a07d66">Select <strong>Configuration</strong> then <strong>End users</strong>
</li>
<li data-list-item-id="e585f026516bb9f0cb07e6a532bea79c9">In the <strong>Anybody can submit tickets</strong> section, turn on <strong>Require authentication for request and uploads APIs</strong>
</li>
<li data-list-item-id="e0fab07951a4cadf10d390c21b57c6057">Click <strong>Save</strong>
</li>
</ol>
<div class="p"><div class="note">
<span class="notetitle"><strong>Note</strong>:</span> Authentication prevents anonymous ticket creation through sources such as the Web Widget contact form, custom apps, and external web forms. Confirm that these sources don't rely on anonymous submissions before turning on this setting.</div></div>
<p>For more information, see <a href="https://support.zendesk.com/hc/en-us/articles/4408883052442-Managing-end-user-settings" target="_blank" rel="noopener noreferrer">Managing end user settings</a>.</p>
</div><div class="accordion"><h3 id="h_01M0FVMFJQJCZ59MM9GZD2D5XF">Prevent spam content from reaching end users</h3></div><div class="panel">
<p>Spammers may use notification triggers to send spam content to other users through ticket placeholders. Review your version of the Notify requester and CCs of received request trigger and remove references to {{ticket.title}} or other placeholders that render ticket content.</p>
<p>If the trigger doesn't already include it, add the condition <strong>Current user | Is | (end user)</strong>. This prevents the trigger from sending spam content while preserving notifications for tickets created by agents.</p>
<p>This doesn't stop spam tickets from being created, but it prevents spammers from distributing their content to recipients.</p>
</div><div class="accordion"><h3 id="h_01M0FWA0W47PY7QWQ2T66SH47E">Temporarily block spam domains</h3></div><div class="panel">
<p>To block ticket creation from a domain or email address across channels, add the reject: modifier before the domain or address in your blocklist. For example:</p>
<pre class="wysiwyg-code-block"><code class="language-auto">reject:domain.com reject:name@gmail.com</code></pre>
<p>Without the reject: modifier, the blocklist affects only domains received through the email channel.</p>
</div><div class="accordion"><h3 id="h_01M0FWF7P2GM6H0DZVF8MJZTSR">Bulk delete in views</h3></div><div class="panel">
<p>Delete multiple tickets at a time using the <a href="https://support.zendesk.com/hc/en-us/articles/4408886890906-Managing-tickets-in-bulk#topic_d5y_3mf_wf" target="_blank" rel="noopener noreferrer">bulk delete</a> feature within views. Identify the spam tickets within your views and manually select each ticket you wish to delete.</p>
<p class="wysiwyg-text-align-center"><img src="https://support.zendesk.com/hc/article_attachments/9512387891482"></p>
<p>Select the <strong>Delete</strong> option after selecting all the tickets in that view. This option is recommended if you have a relatively small number of spam tickets as you're able to delete only 100 tickets at a time. Tickets can be bulk-selected across pages.</p>
</div><div class="accordion"><h3 id="h_2ffec335-5f13-4dc4-8666-a07886001aba">Bulk mark tickets as spam</h3></div><div class="panel">
<div class="note important">
<span class="importanttitle">Important:</span> If the spam tickets were created by submissions to your external contact form which is forwarded to Zendesk by email, don't use the <strong>Mark as spam</strong> option. This can cause an issue where you're flagging your form submissions as spam, rather than the person who filled it in. In turn, this can lead to issues where Zendesk sees this external form as spam, or your email domain could even be on the blocklist.</div>
<p><a href="https://support.zendesk.com/hc/en-us/articles/4408842999066-Marking-a-ticket-as-spam-and-suspending-the-requester" target="_blank" rel="noopener noreferrer">Marking a ticket as spam</a> not only permanently deletes the ticket, but also suspends the requester, preventing them from being able to create further tickets. You can mark up to 100 tickets as spam at a time. Tickets can be bulk-selected across pages.</p>
<p><img src="https://support.zendesk.com/hc/article_attachments/9512387891738"></p>
</div><div class="accordion"><h3 id="h_07f080dd-a288-44b2-b806-d2687b48a90a">Bulk close with an automation</h3></div><div class="panel">
<p><a href="https://support.zendesk.com/hc/en-us/articles/4408832701850-About-automations-and-how-they-work" target="_blank" rel="noopener noreferrer">Automations</a> run hourly and can act to close these tickets. Although this option doesn't delete the tickets, it places them into a closed status and removes them from your live ticket queues. The automation can also add a spam tag to the ticket. If you have an Explore Professional or higher plan, you can use custom reports to filter the tagged spam tickets out of your reports or to identify them later for deletion. For more information, see <a href="https://support.zendesk.com/hc/en-us/articles/4408838151450-Reporting-with-tags" target="_blank" rel="noopener noreferrer">Reporting with tags</a>.</p>
<p>Automations can act on only up to 1,000 tickets during each hourly run. If you have several thousand spam tickets, it may take several hours for those tickets to be closed. For example, if you had 30,000 spam tickets in your account, it takes a minimum of 30 automation cycles, or 30 hours, for the automation to completely remove these tickets.</p>
<p>To set up this automation:</p>
<ul>
<li data-list-item-id="ebf4ac9d795b4fedbe17373464c8f3c04">Determine a way to identify these spam tickets, such as a specific string in the description, a certain ticket creation timeframe, or a specific requester language</li>
<li data-list-item-id="e76b0970b99877657070e0278bcef487c">If there isn't a single identifying feature among all the spam tickets, use a combination of different identifying conditions to help the automation determine which tickets to run on</li>
</ul>
<p>Below is an example of how to configure an automation to close and tag tickets based on the presence of a particular string:</p>
<ol>
<li data-list-item-id="eddb45760b50b074a849e77cb4038b97e">Create the <a href="https://support.zendesk.com/hc/en-us/articles/4408883801626-Creating-and-managing-automations-for-time-based-events" target="_blank" rel="noopener noreferrer">automation</a>
</li>
<li data-list-item-id="ea78be2ff177102f250e1da9ceb9539f2">Under <strong>Meet all of the following conditions</strong>, add <strong>Ticket: Hours since created</strong> | <strong>Greater than</strong> | <strong>1</strong> and <strong>Ticket: Status category</strong> | <strong>Less than</strong> | <strong>Solved</strong>
</li>
<li data-list-item-id="e4b1f391a237142420269794ef0761ad1">Under <strong>Meet any of the following conditions</strong>, add <strong>Ticket: Description</strong> | <strong>Contains the following string</strong> | Enter common strings</li>
<li data-list-item-id="e7533364152f6c2d89cd453aa5f22a55f">Under <strong>Perform these actions</strong>, add <strong>Ticket: Set tags</strong> | <code>spam</code> and <strong>Ticket: Status category</strong> | <strong>Closed</strong>
</li>
<li data-list-item-id="e4c0c7b5b97481a5f77b14a3e87432969">Click <strong>Create automation</strong>
</li>
</ol>
<p><img src="https://support.zendesk.com/hc/article_attachments/10569892272538" alt="Automation setup to close spam tickets.png" width="1970" height="1238"></p>
<p class="wysiwyg-text-align-left">In the example above, <strong>Ticket: Description</strong> is placed under <strong>Meet any of the following conditions</strong>, in case multiple strings are used to identify spam tickets. You can add as many of these additional conditions as needed to ensure all of your spam tickets are addressed by a single automation.</p>
<div class="note">
<span class="notetitle">Note:</span> In accounts with <a href="https://support.zendesk.com/hc/en-us/articles/4412575861018-Creating-custom-ticket-statuses" target="_blank" rel="noopener noreferrer">custom ticket statuses</a> deactivated, use the <strong>Status</strong> conditions instead of the <strong>Status category</strong>.</div>
</div><div class="accordion"><h3 class="note" id="h_aae7a070-260d-4576-a7c4-d935e8df4cca">Bulk delete tickets through the API</h3></div><div class="panel">
<p>Utilize the Zendesk API to bulk delete tickets. Using this option means you are restricted to deleting 100 tickets at a time. However, if you have developer resources, the API can be leveraged in a script to run continuously in the background until all the spam tickets are deleted as well. For more information on using the API to bulk delete tickets, see <a href="https://developer.zendesk.com/api-reference/ticketing/tickets/tickets/#bulk-delete-tickets" target="_blank" rel="noopener noreferrer">Bulk Delete Tickets</a>.</p>
<div class="note">
<span class="notetitle"><strong>Disclaimer</strong>:</span> This option is provided for instructional purposes only. Zendesk doesn't support the code needed to create the script. Post any issues you have in the comments section or try searching for a solution online.</div>
</div><div class="accordion"><h3 id="h_757fc60e-f1db-4e3f-885b-eb4a5b7f68cc">Install third-party apps from the Marketplace</h3></div><div class="panel">
<p>Some third-party apps available in the Marketplace can help you delete or restore tickets on a large scale. One example of those apps is the <a href="https://www.zendesk.com/marketplace/apps/support/206749/gdpr-search--destroy/" target="_blank" rel="noopener noreferrer">GDPR: Search &amp; Destroy</a>.</p>
<div class="note">
<span class="notetitle"><strong>Disclaimer</strong>:</span> This option is provided for instructional purposes only. Zendesk can't provide support for third-party apps. Reach out to the app developer's support email address under "App details" in the App Marketplace or try searching for a solution online.</div>
</div>