Zapier's webhook is spammed not from my website?

  • 5 September 2022
  • 3 replies

I implemented a webhook for collecting emails on my blog articles for collecting email newsletter leads. I send these emails to Hubspot as a CRM. I use NeverBounce step to make sure that the emails are valid.

I can see that each day 3-5 emails get collected, so 3-5 tasks initiated each day on Zapier for this particular zap.

Recently I saw a weird behavior, I got 1250 emails (tasks) on the Aug 29th & 900 on the Aug 30th and 800 on Sep 5th.

16th - 28th Aug: 3 tasks daily average

29th - 30th Aug: 1050 daily average

31st - 4th Sep: 4 tasks daily average

5th Sep: 850 tasks


On these spikes days, I didnt have more than 500 daily session on my website, so it doesn't make sense that these emails are from real people.

Im wondering if someone spamming my website, and if yes, how can I know it? Is there anyway that someone can reach this webhook and spam it? It feels like it these emails didnt arrive from my website and I dont understand why it happens.

Side notes:

  • I have other places on the website where I have emails optin with Zapier zap that never had this issue before, all of them have stable Zap running each day.
  • Webhook was implemented correctly with my developer
  • All the emails look ok and not spamming + passed the NeverBounce filter.


Please let me know how can I solve it and if someone else had this issue🙏🏻

This post has been closed for comments. Please create a new post if you need help or have a question about this topic.

3 replies

Userlevel 7
Badge +14

Hi @Ofir Auto 

Good question.

The best place to troubleshoot is the Zap Runs history details to see the DATA IN/OUT for each Zap step.


I took a look into it but didn’t find relevant things, The only thing I get from data out is the email address, which 100% of them look real. 

Is there any way that someone can use my webhook somehow not from my webstie and spamming it? @Troy Tessalone 

Userlevel 7
Badge +14

@Ofir Auto 

If someone knows the unique Webhook URL then yes, they could trigger the Zap, but they won’t know how the Zap steps are configured and what would be expected data points, so you could perhaps put a Filter as step 2 to make sure certain data is present, or vice versa.