Spam Prevention/Reduction - Contact Form?

Question

I want to add a simple Contact form to my web site so that customers can contact me easily.

    NAME
    

        

Answer 1

Hidden fields, silly questions (what is 3+4?), etc, are not very effective at blocking spam on forms, IMHO.

I researched this several years ago, and came up with a solution I call "FormSpammerTrap". It uses JavaScript code to 'watch' for focus/onclick on required fields. Automated processes, unless highly customized for a specific site (which takes more time than spambot owners want to take), can't 'focus/onclick' a required field. (And there are some other techniques I use.)

I have a free solution at my www.FormSpammerTrap.com site. And there's a form there that spambots can try to spam...and they haven't, for more than 3 years. You are welcome to try it out...it's all open source, so you can see how it works. (And, if you use the form, I don't harvest your email. I reply once, then delete your email.)

My technique is much more effective in blocking spambots, IMHO. They haven't been able to spambot the contact form on that site.

**Added 12 Jul 2018 ** The trick is to add an on-click/on-focus event that changes the action parameter to the actual processing page. Otherwise, the default value I use is a honeytrap-type site. I think it's hard for a spammer to simulate those events, although possible perhaps. The technique blocks a lot of bot-spammers.

And still, after a couple of years using the technique on that site, the form hasn't been spammed by bots. (I define a bot spammer that sends multiple submits via the attack, not just one submit.)

Works for me.

Answer 2

Use Google or Yahoo mail account. They have good anti-SPAM filters.

Answer 3

Use JS technology. Like if a user comes on your contact page then javascript will generate a string or anything like that you prefer and put the information on a hidden text field. But it is not the actual solution, smart bot can easily crack it.

Another way is, You can also use email verification after contact form submission. And store the data on your database. If customer verifies the url through email then the contact information will mailed to you from database.

And also use delay to prevent continuous robot attack. Like sleep() in PHP code. This will add few delay in your code. By this way you can reduce random attacks but this is not the prevention method.

Answer 4

You won't need to reduce spam cause the messages are not published on the website. A lot of spam is posted on forums and blogs because this will reach a large audience of viewers and bots.

For a private contact form, spam is ineffective, so you won't have to worry about large amounts. The few spam messages that you will receive can effectively be filtered with a spam filter on your inbox (for instance using gmail or yahoo), especially since the incoming messages are plain text without images.

Answer 5

A very simple trick I've been using with a surprisingly good success rate is this: Provide a text field that is hidden from human users with style="display: none", but with an enticing name like email. Most bots will fill in something in this field, but humans can't see it so they wont. At the server, just make sure the field is empty, else treat the submission as spam.

Answer 6

#sec {
  visibility: hidden;
  padding: 0;
  margin: 0;
  height: 1;
}

<form method="POST" action="www.google.com">
  NAME
  <input type='text' name='name' />
  <br /> EMAIL
  <input type='text' name='email' />
  <br /> MESSAGE
  <textarea name='message' /></textarea>
  <br />
  <input type='text' name='security' id='sec' placeholder="Do not enter anything here" />
  <input type='submit' formaction="" />
</form>

**Here, only a user who clicks on the submit button actually could submit the form. using auto submit simply redirects the bot to google.com. **

*Also the input 'security' is an input field that is hidden to users, and visible to certain bots, known commonly as HoneyPot Captcha. On the server side, you can simply skip all the requests that has the 'security' field filled. Not every bot can be tricked this way, and this is where the attribute formaction comes into play *