I run a website for a small company. The site has been around since the mid-1990s, and bots are a minor annoyance, but not a problem. We also use some simple h

I run a website for a small company. The site has been around since the mid-1990s, and bots are a minor annoyance, but not a problem. We also use some simple heuristics to reject obvious bot traffic. One of the simplest is to have a form field that is hidden via CSS. Humans don't see it and it stays blank. Bots fill it in. Bots tend to fill in every form fields with random garbage, even checkboxes. Validating checkboxes rather than checking they have a value is another good way to detect bots. Many bots have a hard time with CSRF tokens in hidden fields. Many bots also don't handle session cookies properly. If someone submits a registration form without an existing session, we reject it. (So we don't get as far as checking the CSRF token.) After a certain number of failed attempts to register or login, we block the IP for a period of time.