7 ms·

One quick win that might catch most of the bots is using CSS to hide an dummy form input. No human will see it if their browser properly renders, but bots usin

One quick win that might catch most of the bots is using CSS to hide an dummy form input. No human will see it if their browser properly renders, but bots using CSS selectors might fill it in. If you see that field is filled in then you have a high probability of it being a bot and can drop it.

foxhop 6y ago
yup. This really works for dumb bots.
ficklepickle 6y ago
Regarding the hidden form input, make sure you aren't blocking screen reader users/the visually disabled accidently. Make sure you can't end up in that input with the tab key. I've found that comments submitted in less than 7 seconds from page load are spam. On a few low traffic sites I just discard anything faster than that. A few bots seem to load a page, wait a while, then come back to it. But by and large they seem to try to submit the comment immediately after page load. Mind you, this was on low-traffic sites. High traffic sites I'm sure see more varied techniques.
- foxhop 6y ago
  I like this. I'll add something like this to the backlog.
- rovr138 6y ago
  `aria-hidden` and `display: none` should effectively hide it from screen readers and you shouldn’t hit it with tab.
  - esperent 6y ago
    Do you need both, or is `display: none` enough?
    - rovr138 6y ago
      display: none should be enough. If you notice issues while testing, aria-hidden is a good thing to have in your back pocket
deanclatworthy 6y ago
This is trivial for most bots to bypass nowadays with headless browsers and such.