Yes, there is BlackHat software (Spambots) that sign up accounts on forums and other websites. The software even waits 10 minutes (or however long you like) bef

Yes, there is BlackHat software (Spambots) that sign up accounts on forums and other websites. The software even waits 10 minutes (or however long you like) before it actually clicks on the various links in any emails it receives - so just having a "confirm this email account" link in your confirmation email isn't enough to block these spamming accounts. Because a CAPTCHA is generally abrasive for users as they sign up (it adds an extra step, friction, and hence reduces signups), it's more advisable to use a hidden field (or two) in your form that are REQUIRED to be left blank. These are called TRAP FIELDS. The idea is this: you create a field that is required to be left blank, but you name is something legit like "name". Hide the field with css (like "display: hidden;"). In your controller, you simply require that the field be left blank for the form to be accepted. This defeats about 85% of the dumbest spam account signup bots, because they will try to add a value to that field, and your controller will reject the entry, etc. More tips/tricks about TRAP FIELDS here: http://www.kirsle.net/doc/submitter.html http://www.kirsle.net/doc/submitter.html