3 ms·
The answer is use other techniques to block spam bots. Honeypot fields (user invisible fields, bots assume to fill in all fields in the source regardless of if
by pilom 15y ago
The answer is use other techniques to block spam bots. Honeypot fields (user invisible fields, bots assume to fill in all fields in the source regardless of if those fields are rendered for a user) and timing data entry (no human can fill in a form with a few fields in .3 seconds like a bot can) both are not broken (yet) and do not have a measurable negative affect on conversions.
- jakubw 15y agoI'm surprised these techniques are still effective, especially the hidden field trick. It's not rocket science to embed a proper Web layout engine into an application these days so the bots should already be doing that rather than working with plain HTML.
- mike-cardwell 15y agoI've been doing the hidden field trick for the best part of a year now and it's still working brilliantly.
- rorrr 15y agoAlso putting randomly placed, "randomly" named hidden field with "random" data works well. For instance, you could put encrypted salted timestamp in there, and then, when you get the POST back, make sure the timestamp is not older than X minutes. In fact, all your fields could be named that way, as long as you're willing to decrypt the names on POST.
- duskwuff 15y agoAd-hoc techniques work great until your site (or the software you're using) is popular. Most web spam is done on a large-scale basis; as soon as a particular type of CAPTCHA is popular enough, or appears on an important enough site, web spam software will start including heuristics to defeat it.