Bots can also circumvent this JS thing, so it's the same either way. <?php echo '<input type=hidden name=starttime value='.time().'>'; On submit: <?p

Bots can also circumvent this JS thing, so it's the same either way. <?php echo '<input type=hidden name=starttime value='.time().'>'; On submit: <?php if (time() - $_POST['starttime'] < 4) die('2fast4me'); Revealing the error condition (that it was submitted too fast) is nice for users and bots alike, of course. Up to you. I've had websites where I was too fast in submitting a form before. Not any kind of anti-spam, just their server was so fricking slow that I had input the date (iirc it was a reservation system) and clicked next before the JS blobs had finished triggering each other and fully loaded. It would break the page somehow with no visual indication. I found out by looking in the dev console and noticing stuff was still loading in the background. How normal people are able to use the Internet with how often I need the dev console to do entirely ordinary things is a mystery to me.