Preventing Spam

Question

How do you stop bots on a page which is accessible to registered users only? 90% page is accessed by real users and 10% are bot.

I do not want to put captcha or veri

Answer 1

One trick I like to use is to add a hidden input field to my forms that a real user would never see or change, but that a bot would blindly fill out.

Something like

<input name="spam_stopper" value="DO NOT CHANGE THIS" style="display:none;"/>

and then, in your form handling code, make sure the value of spam_stopper is "DO NOT CHANGE THIS".

A smart bot may ignore display:none, but that's not too likely - many do ignore <input type="hidden"> though, so I wouldn't use that...

Answer 2

Firstly, do you do human-verification on sign-up? That's the first step you should take to prevent spam on your site. Captchas are very effective, and even if you don't want to make users answer a captcha each time they post on the site, having them fill one out to create an account is perfectly reasonable. It only takes 2-3 seconds, and they only need to do it once.

If you're not willing to do that, you're going to have to put up with spam so long as your site is indexed in search engines.

Answer 3

Prevent not sort out the spam

Answer 4

Given you have excluded captcha (which isn't 100% bulletproof), you need to check what your users type and allow or forbid their postings.

This task isn't going to be an easy one, so I would suggest to turn your attention to ready-made solutions such as Akismet.

Answer 5

Since these bots don't follow robots.txt, you can always block them with an .htaccess, but it's lot of work (need to maintain the block list) since bots/spammers often change IPs. You also risk to block genuine users.

You can see Block Bad Bots for an example.

It can be useful but it's often too much work to block all of them VS let's say a CAPTCHA or similar system.

Answer 6

Yes, CAPTCHAs are not user-friendly. There are a few techniques that you can use to prevent spams without using CAPTCHAs which some of them have been already mentioned by others:

• Smarter Server-side Validation: This is specific to the form but for example in contact us form you can filter lengthy messages or messages including a lot of URLs. Or if you expect to get an email you can ping the domain.

• Blacklist Mechanism: flag spammers by IP or phrases in a blacklist database. If you're using PHP a simple library like Guard can be helpful

• Honeypots: This is already mentioned in the accepted answer

• Time-based Protection: To check time to post a request is more than X seconds

• Score-based Google reCAPTCHA v3: This version is totally re-designed compared to the previous one and detect spams behind the scene.

I've written a post recently and you can find more in depth there.