How We Helped Merch Express Block Spam Quote Requests Without Image Puzzles: Complete Case Study by AurixLab

About Merch Express

Merch Express is a Calgary company that makes custom apparel and promotional products. It has operated since 1994 and traded as Budget Promotion until its recent rebrand. The company reports more than 20,000 customers across Canada.

Its buyers include schools, sports teams, trades crews and corporate offices. The team decorates orders in-house with screen printing, embroidery and DTF printing. Every order begins with step one of its process: a quote and creative consultation.

That makes the quote inbox the start of the sales pipeline. Customers reach it through merchexpresscanada.ca, which we built on Shopify.

The Problem: Bots Filled the Quote Inbox

In August 2026, bots began sending fake quote requests through the Merch Express forms. The requests used invented names like "Zydi Prhurtv (Gimxk LLC)" and "Xhjmdn Iqxtojc (Xehlsbuvc LLC)". They arrived 3 at a time, within about 3 minutes.

Each fake quote cost the business in 3 ways:

• Staff time: the team read and dismissed quotes that could never become orders.
• Email reputation: each fake quote triggered an automatic follow-up email to a junk address. Repeated sends to junk addresses can push real quote emails toward spam folders.
• Security risk: submitted text went into staff emails unfiltered. Attackers can use that route to inject harmful content into an inbox.

Root Cause: The Checks Ran Only in the Browser

The old spam checks ran only in the visitor's browser, so bots skipped them. Browser code runs on the visitor's own device. A bot that posted straight to the quote server never loaded that code. The old server accepted whatever arrived.

Cloudflare's guide Validate the token says the browser widget alone does not protect a form. An attacker can send any string to the form endpoint without passing a challenge. The rebuild set one rule: every check runs on the server, beyond a bot's reach.

The Solution: Six Layers of Server-Side Protection

We built 6 layers of protection, and all 6 run on the Merch Express server. Each layer stops a different kind of attack. A bot that gets past one layer still meets the next.

The first layer is Cloudflare Turnstile, a free tool that replaces CAPTCHA puzzles. It checks visitors in the background, so most people never see a challenge.

The rebuild also closed the injection route. The server now cleans every submitted value before it enters a staff email.

How the Server Checks Each Quote

Every submission now passes 5 server checks in a fixed order. Only a submission that clears all 5 reaches the team.

Two things happen before the visitor clicks submit:

1. The Turnstile script loads only when a visitor starts a form. Page browsing stays fast.
2. Cloudflare checks the visitor in the background and issues a one-time pass. Most visitors never see it, and an unusual visitor may need to tick 1 box.

A failed check stops the submission at that step. The name check only flags, so real quotes with unusual names still arrive.

Where the Protection Runs

All 6 live forms that send quotes or messages share the same protection.

The forms feed 3 server entry points: quote, contact and webstore request submissions. All 3 run the same checks. A bot that bypasses the forms still meets the same 6 layers.

Live Site Test Results

All 3 attack-style tests against the live server failed on October 20, 2026. We ran each test the way the spam bots worked.

The gibberish-name detector caught all 8 real spam names in testing. It raised no false alarms on 9 unusual real names. The detector still only flags names, so an unusual real name always reaches the team.

What Customers Experience

Real customers see no image puzzles, and most never notice the check at all.

• Invisible checks: customers face no "click the traffic lights" tests. At most, an unusual visitor ticks 1 box.
• Fast pages: the Cloudflare script weighs about 750 KB. It loads only when someone starts a form.
• Outage fallback: quotes still go through if Cloudflare is unreachable. The other 5 layers stay active.
• Review flags: the name detector marks doubtful quotes for review and never stops a customer.

Load speed affects search visibility as well as visitors. Google's Search documentation says its core ranking systems reward a good page experience. Page speed is part of the technical work in our SEO services in Calgary. The team kept the script off every page view without form activity.

Handover and Maintenance

Merch Express can rotate its keys or change its limits without new code.

• The public Turnstile key sits in the Shopify theme.
• The secret key lives only in the server's secure settings, never on the website.
• The team can replace both keys from the Cloudflare dashboard at any time.
• The team can change the hourly and daily limits in server settings without code edits.
• The server log records each blocked attempt and the check that stopped it.

Three Lessons for Businesses with Quote Forms

Three lessons from this project apply to any business that takes quotes online.

1. Run every spam check on the server. A script that posts straight to the server skips every browser check.
2. Stack different kinds of checks. Turnstile, limits, a honeypot and validation each stop a different attack.
3. Flag doubtful quotes for a person to review. A false alarm on a real buyer costs a sale. Uncertain cases go to staff.

We can review your quote and contact forms and add the same server-side checks. This work is part of AurixLab's web design and development services in Calgary. Book a free 30-minute growth mapping call to start.