Between a simple captcha and a CSRF token, I've found that nearly all spambots are defeated. Hidden form fields don't do much, since bots are almost never payi

Between a simple captcha and a CSRF token, I've found that nearly all spambots are defeated. Hidden form fields don't do much, since bots are almost never paying attention to anything other than the DOM. What can work well -- if you're willing to give up on fallback for non-JS users -- is inserting a required form element into the page with JS on submit.