Here is a fun story: years ago I avoided using CAPTCHAs on my sites by simply adding a hidden file upload field (hidden by js) and a hidden field that was expec

Here is a fun story: years ago I avoided using CAPTCHAs on my sites by simply adding a hidden file upload field (hidden by js) and a hidden field that was expected to be empty. Lots of spam bots did not run JS back then and tried posting values in fields that were supposed to be empty. And then there were many many bots that could not properly form an empty multi part upload request, because that was not implemented in the most popular web request libraries (like curl). It is probably not as effective anymore since it's way easier to run the headless browser these days, but I used that approach for many years. :) My log files were full of spam that was caught this way.