Back in January, I posted about a way to help combat web to lead spam. That type of solution works well, but is not scalable. Also, it is a reactive approach rather than a proactive one.

I decided to try and see if I could incorporate Akismet into the web to lead process and I was successful in doing so! I created a set of scripts for you to download if you’d like to leverage Akismet with your web to lead forms.

Akismet is the best spam tool I have ever used. When I posted in January, it had captured 7,680 spam in its existence on this blog. Less than 4 months later, the spam count is up to 23,994. Needless to stay, spam is an exponentially increasing problem and will plague your Salesforce.com environment eventually. I feel that Salesforce.com needs to include a spam filter in their product for web to lead (vote for it).

Until then, leveraging Akismet could help you significantly.

About the Solution

The scripts are intended to be proof of concept for you to use and apply to your own environment. The code and downloads are now being officially hosted at Arrowpointe’s Open Source Project at Google.

To use this solution, you’ll point your web to lead forms to this script rather than to the standard Salesforce Web to Lead page. The script accepts the data from your web to lead form, passes it to Akismet to determine whether it’s spam or not and then passes the data to Salesforce.com’s web to lead page with the Akismet result appended to it.

In Salesforce, you’ll need to add checkbox field (e.g. “Akismet marked as spam”) on your Lead. If Akismet thinks it’s spam, that field will be set to TRUE. You would then need to add assignment rules or validation rules to do whatever you need. For example, you could have a lead assignment rule looking at that one checkbox field and put leads into a special queue if they are marked as spam.

The script leverages the Akismet PHP5 Class to handle the core communication with Akismet. I found this class from the Akismet Development page.

This script will only work on PHP5 and requires the cURL module to be enabled. cURL is enabled by default in most PHP installations. The PHP5 requirement is a limitation of the Akismet PHP5 Class. If you are on another platform (PHP4, Ruby, Java, etc.), I don’t see any reason why you couldn’t use these scripts and integrate a different Akismet toolkit into it. Additional toolkits are available from the Akismet Developer Page.

Cost

You’ll need a server running PHP5. If you have a server already setup, then hardware should cost you nothing.

Akismet is free for personal use, but has a small license fee for commercial use. If you will be using this in production, you should purchase an Akismet Commercial License Key. During development, I am sure you could use a personal key to make sure it works.

The scripts themselves are free and licensed under the GNU General Public License v3. I did this as a proof of concept for the betterment of Salesforce.com data quality everywhere.

Getting Started

1. Add a checkbox field to your Salesforce.com Lead Object that will hold whether Akismet thinks it’s spam or not.



2. Download the scripts. Three files will exist in the zip file:
   • index.php: The main script that handles the incoming data, talks to Akismet and posts the data to Salesforce.com Web to Lead.
   • constants.php: You will need to go into this file and edit some variable values based upon your own organizational setup. See the next step.
   • Akismet.class.php: This is the Akismet PHP5 class I was talking about above.
3. Edit the constants.php file:
   • Enter your Wordpress API key where it says ENTER_WORDPRESS_API_KEY. Get a personal or commercial key if you don’t have one.
   • Enter your company URL where it says ENTER_YOUR_COMPANY_URL.
   • Enter your company’s Salesforce.com Org ID where it says ENTER_YOUR_SALESFORCE_ORG_ID. This is actually optional. Doing this allows you to remove the OID from your public web to lead forms so spammers don’t know your Org ID. Doing this will reduce the amount of spam you actually need to process.
   • Generate a web to lead form in your Salesforce setup. Find the new Salesforce field you created in step 1 and copy the id value from the HTML form and put it in the constants.php file where it says ENTER_THE_W2L_CUSTOMFIELD_NAME. This step is required so that your Salesforce org is actually populated with the Akismet result.
   • PHP Advanced: The $Akismet_noPass array holds the names of fields that should not be included in the content passed to Akismet. Feel free to add/remove values from this array. The values in the array are referring to the names of form fields in your web to lead HTML form. I have no idea if this helps/hurts, but it seemed like a practical thing to add into the script.
4. Upload the scripts to your web server and note the fully qualified URL for that directory (e.g. http://www.example.com/web2lead)
5. Update your web to lead forms to have them post to the location of the files from the previous step (e.g. http://www.example.com/web2lead/ – make sure to put the / at the end of the URL. Not sure why, but I wasn’t able to get it to work without it)
6. Test your form to see if it works. The script acts as an intermediary between your form and Salesforce web to lead. The end-user experience should be the exactly the same with or without the scripts.
7. Once you know it works, you should add a lead assignment rule into Salesforce as rule #1 that looks to see if this field is checked. If so, then route the lead to a “Potential Spam” queue or something of that nature. Another option is to create a validation rule that doesn’t even allow the lead into the system.
8. Make sure your Auto Response rules don’t email a reply to leads marked as spam. If you allow this, then those spammers have an email address to try.
9. Update some/all of your web to lead forms to post to this new page. If desired, remove the “oid” field from the HTML form for each of these since the script will pass your Org ID to Salesforce automatically.

Other Stuff

These scripts are a proof of concept. I am not officially supporting them, but am happy to help people out informally. Post comments here if you have questions/comments/criticisms.

I have only tested this with leads that were either real or very obviously spam. It worked well. From Akismet’s perspective, the data it checks looks just like a blog comment and I can attest that Akismet is amazing at identifying blog comment spam. So it should work well for Salesforce.com web to lead.

I am going to update my existing web to lead forms on this site and see how it works and report back to you. I encourage you to do the same and let me know your experiences with it or recommendations on how to improve the scripts.

Enjoy!

Over the past week, I have had an ever-increasing number of web-to-lead spam entries come into my Org. It gets to be VERY frustrating! Unfortunately, Salesforce.com does not have any sort of anti-spam functionality for web-to-lead (want them to? Vote for it).

What would be great is an add-in to Salesforce.com that evaluates a Lead’s content prior to getting in the Org. Blog software has this for comments. For example, I use Akismet on this blog to take care of the non-stop comment spam I get. It is incredible. It catches 99% of it. If Akismet didn’t exist, I probably would stop allowing comments on this blog.

If you use a tool like Form Assembly or Clicktools for web-to-lead forms, they have functionality to help you. However, what if you don’t?

I discovered that Validation Rules work pretty well. If you can determine any consistencies with the spam you are getting, create a Lead Validation Rule to stop it. For example:

AND(
ISPICKVAL(LeadSource , "Web"),
OR(
CONTAINS( Description , "mortgage") ,
CONTAINS( Description , "diploma") ,
CONTAINS( Description , "auto loan")
))

The Validation rule above will cause an error for any lead with a Lead Source of “Web” AND the Description contains any of the following: “mortgage”, diploma”, “auto loan”. You can make the message of the validation rule say “This is Spam”.

Web to Lead records do not get created if they don’t pass the Validation Rule. However, you will get an email from Salesforce Support with a subject of “Salesforce Lead Alert” with the Lead information in it. What I did was to create an email rule that label emails meeting the following criteria (another alternative would be to delete them):

• From Salesforce Support
• Subject of “Salesforce Lead Alert”
• With “This is Spam” in the message body

If you go this route, be careful not to make your Validation Rule too generic. You could end up stopping a good lead from coming in. If you do happen to neutralize a good Lead, the lead’s information will be in the “Salesforce Lead Alert” email you received. It’d be a good idea to review those emails from time to time.

This is not a long term solution, but can help alleviate some pain.

An alternative approach would be to do something similar with Workflow Field Update Rules or Lead Assignment Rules and to auto-set the Lead Status to “Spam” or to assign it to a “Spam” queue. Doing this will capture the Lead in the database, but will help segment it out of your way.

I remember hearing people at Dreamforce mention that this could become a reality soon, but I don’t recall hearing anything specific about it actually being deployed. However, I am seeing some hints in the application now that it’s been upgraded to Winter 07 that elude to it being a reality.

• There is a field called License Type on the user record. This defaulted to “Salesforce” for all users (as far as I know). The Help explains that there are now 3 potential values here.
• Salesforce License: Designed for users who require full access to standard CRM and AppExchange apps
• Apex Platform Licenses: Designed for users who do not need standard CRM functionality. Users with an Apex Platform user license are entitled to use custom apps developed in your organization or installed from the AppExchange. In addition, they are entitled to use core platform functionality such as accounts, contacts, reports, dashboards, documents, and custom tabs.
• Apex Platform One Licenses: Designed for users who are entitled to use only one custom app developed in your organization or installed from the AppExchange. The app is restricted to five custom tabs. In addition, they are entitled to use core platform functionality such as accounts, contacts, reports, dashboards, documents, and custom tabs.
• There is a new standard App called Platform. This includes the Accounts, Contacts, Reports, Dashboards and Documents tabs.
• In the Company Profile screen, there is now a list of Licenses for your organization. A record exists for each of the 3 license types I mention above.

I cannot find very much information on how one can buy an org with Apex Platform Licenses only. The ability to purchase a platform-only license like this would be huge. It would obviously provide a platform for companies to build apps on even though they aren’t interested in CRM (yet). It would also instantly provide a very solid, configurable back-end to a web application. This would compete with the MySQLs, Oracle’s, etc. of the world. A benefit over those guys is that you have an instant user interface and robust reporting tools to manage your application’s database.

Does anyone out there have additional information on this licensing model? If so, what capabilities are included? Suppose this license type was added to the Salesforce.com’s edition comparison chart, how would it look?

Someone with average programming skills could cause some destruction via the API if they wanted to and I think some mechanism of locking it down further would be good. Also, since so many applications will be accessing/manipulating data via the API, it’d be good to limit what an app can do (e.g. only access specific objects, read vs. write) and also to track the application that is making changes to records. It’s like having application-specific profiles. When a user logs into Salesforce via a external application, they only get the permissions where their user profile and the application’s profile match (maybe they have delete Account rights in their user profile, but the application profile doesn’t allow deletes. They won’t be able to delete Accounts when using that application).

I don’t have the design all figured out, but it’s the idea I wanted to get across. I am interested in what you all think. If you have an opinion (agree or disagree), please add your comments to the post on IdeaExchange.

http://ideas.salesforce.com/article/show/42227/API_Authentication_List

View their blog post

I think I am interpreting this correctly…

You, as an OEM provider, offer your product/service to both Salesforce.com customers and customers not yet on the Salesforce platform. The OEM Edition only applies to the customers not yet on the Salesforce platform. As an OEM vendor, you pay Salesforce.com $25/month/user for anyone that takes up a license. It is then up to you to pass through that cost to your customer. The end result is that the customer only has a relationship with you, the OEM vendor. You, in turn, have the relationship with Salesforce.com as the platform provider for your product/service. Correct? Please add your comments to help clear this up. It is not totally straight forward in the press release.

This is a step in the right direction, but is not as ideal (IMHO) as the Platform Edition licensing I recommended in April. I feel that another licensing model is still necessary that allows you, as a consumer or corporate purchaser, to buy licenses to the Salesforce.com platform only. And to buy them directly from Salesforce.com. This would be a relationship between you and Salesforce.com with no third party involved. You just pay your subscription fee to the platform. From there, you would have the ability to add to it through AppExchange or by building your own apps. This allows for much more flexibility in that you start with the platform and then select/build the apps you want. Like I said, the OEM model is a step in the right direction, but you need to want one of those OEM products before you can get on the platform. The Platform Edition idea is an option to opt-in to the platform first (like buying a computer with only the operating system and then choosing the software you want).

Sorting QueryResultSets

When querying data using SOQL, you cannot perform an ORDER BY. I assume this is to protect system performance, but it’d be great if there was some way to perform sorts on your data in the API. Maybe this is having ORDER BY as a parameter in SOQL. Alternatively, there could be a sort() method that can be called once you actually have your QueryResult in memory. This method should allow you to provide a multi-column sort order.

I have seen some sorting functions on the message boards, but they are a bit over my head. It would be nice to have this built right into the product.

Configuring Partners

I echo Gokubi’s recommendation for the ability to configure the Partners object. It would be great to be able to add additional information regarding the relationship between 2 accounts.

More Description fields when configuring

It would be nice to have more areas to input a description when you are configuring. Also, when there is a description field, it’d be nice to be able to see that when viewing the data in a list. For example,

• Display the Description when listing the Fields for an object
• Include a description on the Sharing Rule page and display it when viewing Sharing Rules. Some organizations have 100s of Sharing rules and it’s hard to keep them straight sometimes. Display this field on the Sharing Rule list
• Display the Description field when listing the Profiles
• etc.

Utilize Views in more places in the Setup area

Setup Views on pages like Fields, Profiles, Sharing Rules, etc. so you could include any fields you want on there. You might have a view for Formula Fields that shows you all the formulas right there in one page. Or a Profile view that displays the profiles and all of their Tab permissions. Views exist today when Managing Users. Apply the same concept in other areas of the application so we do not have to drill into each record to see details all the time.

Where is this Public Group Used?

Publis Groups can be very useful for administering access to Reports, Dashboards, Documents, etc. However, it is difficult to know where a Public Group is being used unless you click into every folder. It’d be nice to have a view from the Public Group page to see where it is being used.

Picklists in Formula Fields

Right now, you cannot simply grab the value of a picklist field in a formula. You have to know the value you are looking for and use the ISPICKVAL function. Alternatively, you need to create a formula field for the picklist and go through every possible picklist value and output its corresponding text. This can be burdensome. There should be a way to simply reference the picklist field in a formula and use its value.

Formula Field Length

The workaround to the issue with picklist fields is to create a formula field that does an ISPICKVAL function on every possible picklist value and then outputs the equivalent text. The max formula size is 1000 characters, so sometimes you need to create multiple formula fields to accomplish this. If the Picklists in Formula Fields wish isn’t fulfilled, then the max length of a formula field should be increased.

However, their licensing model is CRM application first and platform second. Today, you cannot purchase Salesforce.com licenses to utilize just the platform. Is this coming? What would it include? In my mind, it should include:

• Very Important
• Full access to the user & security components (users, profiles, public groups, field-level security, secure authentication, password generation, etc.)
• Full access to Custom Objects, Custom Tabs, Custom Applications, S-Controls and Get/Share with the App Exchange
• Sharing Rules (role hierarchy, including functionality to setup sharing rules for custom objects)
• API Access
• Reports
• Ability to brand all system communication (welcome emails, notifications, etc.)
• Somewhat Important
• Activity Management
• Notes & Attachments
• Documents
• Workflow
• Email Templates
• Sforce Data Loader
• Dashboards

The ability to buy this kind of license should be self-service with no need to work through a sales rep. I can envision going to the Salesforce site to sign up for a Platform Edition org (a unique instance of the application), input my information (contact info, billing information, etc.) and I am in. The cost model could be based on user logins and volume (API calls or storage). Perhaps there are cost tiers with maximum thresholds on # of users and/or volume before you auto-move to the next tier. This would make it easier to manage and predict cost. Billing would take place automatically at the end of each month against a credit card or other payment service like Paypal.

If something to this effect is done, it opens Salesforce up to a whole new market. Gone is the limitation of having a CRM license to take advantage of the platform.

I would suspect that something like this is on its way, but I have no evidence to support this. Does anyone know anything about this?

Bubble Help

This could improve usability quite a bit. It’d be great if we had the ability to configure a 1 to 2 sentence bit of help text on a field. It would work similar to the graphic on the right where Salesforce allows you to hover over the information icon for a bit more detail on that piece of functionality.

It’d be really nice have this capability at the Field level. Then, at the page layout level, you would have the ability to show the bubble help text (or not) for each field on the page layout.

Campaign Visibility & Sharing to allow for broader Campaign usage

I have written about this before, but the need comes up on almost every project I am on. Users regularly request the ability to manage a campaign-like event. This could be a seminar they are conducting, a dinner they are holding, responses to a series of emails they are sending about a new product line, etc. The Campaign module fits this mold perfectly. However, in today’s world, a user needs the Marketing User permission to run any kind of Campaign. Once they have that permission, they have visibility and edit rights to every Campaign in the system.

I am suggesting the Campaign object utilize sharing rules similar to Leads, Accounts, etc. This would allow users to setup personal campaigns without having to work through marketing and without having read-write access to every campaign in the system. This would support the ability to have:

• Standard Company Marketing Campaigns viewable by everyone.
• Private Company Marketing Campaigns viewable only by Marketing & key Executives.
• Private Personal Campaigns viewable by the owner of the campaign and those that they report to (up the role hierarchy).

Threaded Activity Discussions

The Activity History list can become overwhelming, especially when being viewed at the Account level. It’d be really great to organize the activity history into activity threads. This would result in the Activity History list being viewable in a mode that would look similar to a message board . An email conversation would be organized under a thread. A meeting may spawn follow up emails and follow up calls. All of this could be viewable as a thread of activity history. The ability to expand/collapse these threads would be nice too.

AJAX-ify the UI

Someone well versed in UI design would probably have better ideas than I do, but it’d be great to be able to use AJAX technologies to provide better usability in the UI. The main premise would be to allow you to add/edit data quickly without having to refresh the entire page everytime. Serious study would need to be done by Salesforce.com to understand common workflows and pick the “sweet spots” for improvement. Some random ideas:

• Add a list of competitors next to the Competitor related list on the Opportunity page to quickly add competitors to it.
• Add a similar list for the contact roles related list.
• Ability to quickly log a call in a fashion similar to how you can add To-Dos in Backpack.
• Hover over a link to another record (e.g. the Account field on a Contact record) and get a pop-up preview of key fields on that linked record without having to leave the page you are on. This would act similar to how you can hover over a movie name in Netflix to see a description of that movie with no need to click into that movie’s page.

Tagging records

The del.icio.us / salesforce integration by Thumbware helps with this, but it’d be nice to have it native to Salesforce so that navigation could be improved and so it could be accessed via the API. You should be allowed to tag any record you want. Every record should have a permanent tag based upon the object of the record. For example, an Account record for Arrowpointe Corp. would be auto-tagged with “Account”, but a user could add other tags for it such as “consultant, integrator, salesforce.com”. A tag cloud view would be available to navigate all of your records by tag like you can do on del.icio.us.

Organizing Reports

There is only 1 Personal Custom Reports folder. This folder can grow very quickly and a naming convention is required in order to have any control over it. If a user was allowed to create multiple personal report folders, this problem could be minimized. The new Report Search feature has helped to minimize this issue.

B2C support

Salesforce is an Account-centric system and the Account object is meant to represent a business or organization, not an individual. However, many companies deal directly with individuals (B2C). Today, most of these companies will pirate the Account object to represent a personal account or a household for the purposes of managing Opportunities. They will usually create a Contact record too for the support of email and campaign functions. The concept of a Consumer Account that can be used with Opportunities, Cases, Campaigns and the Send Email function would be great so that you are not required to perform double-entry.

I believe Salesforce is working on B2C support. A client of mine was interviewed by Salesforce on this subject at the end of 2005. They are definitely thinking about it.

Field Validation Rules

Ability to add validation rules against a particular field based upon situational criteria. Example of how this could be used include:

• If Stage = ‘Closed/Lost’, then a custom field called “Reason Lost Comments” is required.
• If Account Type = ‘Customer’, then Account Number is required.
• If Opportunity Probability is > 50%, a primary contact must be associated to the Opportunity

Today, you can work around this limitation by creating a formula field to display an error message when validation rules fail. However, this does not prohibit someone from saving the record.

Please comment with your thoughts and any other items on your own wish list.

Mass Email Activities (more detail)

When using the mass email feature today, it can log an activity for each Contact. However, the activity says next to nothing. It does not contain the text of the email and has no reference to the email template. The activity created should provide the text of the email that went out and any attachments included (just like the Send Email feature does). If that is too much text and SFDC fears it’ll increase database size too much, at least have a reference to the email template that was used.

Campaign Visibility & Sharing

Right now, the Marketing User user profile field gives someone control of the Campaigns. It’d be fantastic if Campaigns were made to work just like the other objects with their own default Sharing Rule and the ability to add Campaign Sharing Rules to extend visibility to Campaigns. I think Campaigns were designed for a centralized marketing group to use. However, the functionality is applicable to a sales user too whereby a Sales person may want to run a personal Campaign. In today’s world, they would need the Marketing User flag set on their profile. This would let them do that, but it’d also let them edit/delete anyone else’s Campaigns.

Keyboard Shortcuts

Some keyboard shortcuts for things like Save, Cancel, New, etc. would be nice. SFDC currently requires heavy use of a mouse. Keyboard shortcuts are especially important on the Supportforce side of the house.

More than 1 personal reports folder

Give users the ability to create more than 1 personal reports folder. It is currently the equivalent of having 1 folder on your harddrive for all of your documents. Users should be able to create multiple folders. That’s step 1. The second (and less important) step would be to allow for a hierarchy of folders. This functionality would negate the need for the HTML component I mentioned in a earlier posting.

Sales History Related List being Customizable

The new customizable related list functionality is great. It’d be nice if the Sales History list was editable too. For example, Expected Revenue is stuck on there. I have yet to see an implementation where my clients puts any significance on that field. We should be able to remove it.

Additional To people on an email

In the summer 05 release, the CC and BCC fields can bring up a list of Contacts to pick from. That link needs to be on the Additional To field too. This may have been a Summer 05 release oversight.

Mass Mail Merge

Allow users to do a mass mail merge similar to how the mass email is performed.

My Personal Mail Merge Templates

Just like having personal email templates, personal mail merge templates should exist.

Personal Bookmarks on Homepage

The ability to add personal bookmarks on your homepage. This might be links to external sites, but could also be a link to a report or another record in Salesforce.com.