Spam, Web-to-X (Case, Leads) requests and Internal Queue and limits
|Knowledge Article Number||000240612|
|Description||Salesforce enforces a maximum number of new Cases (5,000) and Leads (500) generated in a 24 hours period (Salesforce Features and Edition Limits). Once the organization exceeds its daily Web-to-Case or Web-to-Lead limit, the default case owner or default lead creator receives a notification email that contains information about the case or lead. When your organization reaches the 24-hour limit, Salesforce stores additional requests in a pending request queue that contains both Web-to-Case and Web-to-Lead requests. The requests are submitted when the limit refreshes. The pending request queue has a limit of 50,000 combined requests. If your organization reaches the pending request limit, additional requests are rejected and not queued. Your administrator receives email notifications for the first five rejected submissions.
In certain circumstances, commonly due to spam requests, you may reach that limit unexpectedly with non-desired records. Find below a number of recommendations about what you need to do in order to handle those situations.
Make sure that the spam issue is controlled and that no additional requests are being created. The sooner you manage to do this the better in order to avoid the hard limit of 50,000 pending requests. A temporary measure could be to remove the web form from your website until you have a permanent solution in place. Another suggestion would be to create a Validation Rule once you've identified a pattern that would stop the records from coming to your Org. A permanent solution would be to enforce a web-side validation or captcha to make sure that the web form is secure and protected from spam. Also, it'd be a best practice to try to avoid easily-accesible source code directly in your website, you could use other HTML/API methods instead in order to fully protect your web submission.
Identify existing spam recordsYou probably know the time frame when the spam started and you can build reports to easily identify and isolate those unnecessary Leads and/or Cases. Identifying those records and having a report with them would allow you to easily export a .csv file that you could use to remove or manipulate the spam records as desired. This would allow you to prevent your end users being impacted by a large number of not valid records. As suggested above, if you have a clear pattern and records are still being created you may want to implement a Validation Rule in order to stop new records from being created.
What can Salesforce do for you?Salesforce cannot take action on the pending queue, you wouldn't want us to be deleting records (whether they're already existing or pending ones) in your Organization so clearing the queue from our side is not an option. However, we can temporarily increase the number of daily requests processed for your Organization to make sure the requests are processed and you can respond to the legit ones in a timely manner.
In order to do this, please create a case with Support and provide the following information:
Organization ID: the Production or Sandbox Id needing this feature (Navigate to Setup | Company Profile > Company Information)
Requested Limit: How much would you like the limit to be increased? you can estimate the number of records received in order to add a value here.
Requested Duration: Will it be permanent or just for a certain period? based on the requested limit you could calculate for how long you need the increased limit.
Business Reason: Provide an explanation about what happened that makes you required this limit increase.
Other considerations about the records that are pending, over limitQ: What would be the time stamp for the Created Date?
A: The Created Date would be the date the record was actually created and not the date the record was submitted from the web form. So if a Lead or a Case was submitted yesterday but it stayed in "Pending" status for 24 hours the Created Date of the record will be today's date, not the initial submission's one.
Q: If we get a limit increase, will the requests that are over limit be processed immediately?
A: No. That Limit is reset at midnight UTC so if the limit was changed during the day you'd still need to wait until the process kicks off again after being reset.
Q: What happens if the buffer of pending request queue (limit of 50,000 combined requests) is exceeded?
A: If this limit is exceeded, the administrator receives email notifications for the first five rejected submissions but, after that, the requests will be lost permanently.
Web-to-Case Notes and Limitations
What if my company reaches the limit for web-generated leads?
How many leads can we capture from our website?