# Removing suspicious links

**URL:** <https://community.gravityforms.com/t/removing-suspicious-links/10931>\
**Category:** Get Help\
**Tags:** notifications, spam\
**Created:** [October 14, 2021, 5:45pm UTC](https://community.gravityforms.com/t/removing-suspicious-links/10931 "2021-10-14T17:45:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![seilerinstrument](https://sea2.discourse-cdn.com/flex020/user_avatar/community.gravityforms.com/seilerinstrument/32/3781_2.png) [@seilerinstrument](https://community.gravityforms.com/u/seilerinstrument)\
**Post date:** [October 14, 2021, 5:45pm UTC](https://community.gravityforms.com/t/removing-suspicious-links/10931/1 "2021-10-14T17:45:03Z")

</div>

We have been getting contact form submissions that are clearly attempting to get the reader to click on a link using social engineering. The most common among those are messages with a “infringing on copyright-protected images” theme and a link going to [storage.googleapis.com/XXXXXX.appspot.com/](http://storage.googleapis.com/XXXXXX.appspot.com/). With the latest being from a seemingly legitimate email address from [intuit.com](http://intuit.com) of all places. Even though we don’t use any Intuit images.

We also have a security plugin which helps with bots and covers Gravity Forms.

My question is, is there any existing way to remove URL’s altogether? Or maybe hold submissions that contain a URL?

I need a way to combat these social engineering attempts that contain suspicious links. I wanted to ask before attempting to hook into the email notifications and remove URL’s before sending to an office admin that will read it and potentially click on a malicious link.

Thanks,  
Brennan Goewert | Information Systems Technician

---

<div class="post-metadata">

**Author:** ![chrishajer](https://sea2.discourse-cdn.com/flex020/user_avatar/community.gravityforms.com/chrishajer/32/88_2.png) [@chrishajer](https://community.gravityforms.com/u/chrishajer)\
**Post date:** [October 15, 2021, 4:26pm UTC](https://community.gravityforms.com/t/removing-suspicious-links/10931/2 "2021-10-15T16:26:12Z")

</div>

Have a look at this solution which was shared in our forums:

> [@How to block links in text field? \[RESOLVED\]](https://community.gravityforms.com/t/how-to-block-links-in-text-field-resolved/5865/6):
>
> Guys, thanks for your help! Here is the code that worked: // add custom validation to form add\_filter( 'gform\_field\_validation\_74\_7', 'validate\_phone\_74\_7', 10, 4 ); function validate\_phone\_74\_7( $result, $value, $form, $field ) { $nourl\_pattern = '(http|https)'; if ( preg\_match( $nourl\_pattern, $value ) ) { $result['is\_valid'] = false; $result['message'] = 'Message can not contain website addresses.'; } return $result; }

Will that work for you?

---

<div class="post-metadata">

**Author:** ![seilerinstrument](https://sea2.discourse-cdn.com/flex020/user_avatar/community.gravityforms.com/seilerinstrument/32/3781_2.png) [@seilerinstrument](https://community.gravityforms.com/u/seilerinstrument)\
**Post date:** [October 18, 2021, 9:01pm UTC](https://community.gravityforms.com/t/removing-suspicious-links/10931/3 "2021-10-18T21:01:49Z")

</div>

Yes, that should do the trick for us. Thanks!

---

<div class="post-metadata">

**Author:** ![chrishajer](https://sea2.discourse-cdn.com/flex020/user_avatar/community.gravityforms.com/chrishajer/32/88_2.png) [@chrishajer](https://community.gravityforms.com/u/chrishajer)\
**Post date:** [October 19, 2021, 8:40pm UTC](https://community.gravityforms.com/t/removing-suspicious-links/10931/4 "2021-10-19T20:40:23Z")

</div>

Closed on October 19, 2021, 8:40pm UTC



---

<div class="post-metadata">

**Author:** ![richardw8k](https://sea2.discourse-cdn.com/flex020/user_avatar/community.gravityforms.com/richardw8k/32/2354_2.png) [@richardw8k](https://community.gravityforms.com/u/richardw8k)\
**Post date:** [August 27, 2026, 7:25pm UTC](https://community.gravityforms.com/t/removing-suspicious-links/10931/5 "2026-08-27T19:25:40Z")

</div>

Gravity Forms 3.1.0 and newer include [built-in link/URL detection](https://docs.gravityforms.com/spam-detection-and-protection-first-steps/#form-design).