I did something similar for a friend of mine. Slight difference was that I had the best success by pre-populating the hidden field with some static value and c

I did something similar for a friend of mine. Slight difference was that I had the best success by pre-populating the hidden field with some static value and checking to make sure it was set right. Some bots don't fill out the hidden forms, and some do, you could probably use a couple hidden fields to try to catch all types of bots. Also, if you keep some session data, you could place a random value in the hidden field, and expire it on the first hit (for bots that scrape once, and POST many times). The site I put this on is pretty small, so I'd be interested in hearing if any moderately trafficked sites still find this effective.