3 ms·
Best and simplest trick I've found for this is having a CSS hidden honeytrap field, something like <input name="message_body" type="text" class="hideme" /> Bot
by Zikes 13y ago
Best and simplest trick I've found for this is having a CSS hidden honeytrap field, something like <input name="message_body" type="text" class="hideme" />
Bots will put something in the field but humans should never see it, so if the server sees anything in there it can safely toss the whole thing.
- eli 13y agoTwo pitfalls: 1) You should add some text to indicate to people using screen readers that this field should remain blank. 2) You should make sure to name the field something unlikely to be autofilled. There are browser toolbars out there that will happily autofill even hidden fields and trigger your spam filter. But other than that, I agree that this is extremely effective against the common sort of drive-by spam bot. (And, obviously, completely useless against any sort of advanced or targeted attack.)
- Zikes 13y agoExcellent points, thank you.
- aquark 13y agoGood point. My javascript solution uses two hidden fields with very similar names. One that the script fills in and one that it doesn't. Bots will either hit both or neither and get rejected. Screen readers/toolbars may be an issue, though the names would be hard to think what to autofill with. It has never come up in practice -- the reject message tells people to email us directly If you have javascript turned off, you'll need to email directly too -- and the site won't work so there probably isn't much lost!
- deleted 13y ago[deleted]