I run a modestly popular (around 10,000 page views a day) civic affairs website that used to be utterly deluged with spam. The site was becoming unusable and un

I run a modestly popular (around 10,000 page views a day) civic affairs website that used to be utterly deluged with spam. The site was becoming unusable and unmanageable, and I had to do something about it. I wanted to avoid image captchas, which I consider to be a usability barrier. Instead, I implemented a really simple, three-pass filtering system for comments by anonymous visitors (registered visitors can log in and bypass the spam filtering system entirely). It included the following three steps: 1. Ask a very simple grade-school math question using plain text. 2. Check comment text against a list of 56 common spam words. (This is actually rather crude: anonymous comments including, say, "socialism" trip the filter for "cialis"). 3. Include a hidden form field that is supposed to remain blank. That was in June 2008. Since then, not one spam comment has gotten past the filters. I should note that my site, like Tim Bray's, uses a CMS I developed from scratch (starting about five years ago), so it's likewise not subject to the exploits that target Wordpress or Drupal or the other popular CMSes.