>
 





Web sites are increasingly under spam attack from automated scripts. “CAPTCHAs” (Completely Automated Public Turing test to tell Computers and Humans Apart) can help Web sites to distinguish between human and machine users by forming a problem that is easy for humans to solve, but difficult for machines to solve.

CAPTCHA can control many automated spam attacks against Web sites, but without careful planning, it can also cause problems.

CAPTCHA Sample
A Sample CAPTCHA Image 


Because CAPTCHAs rely on perception, users unable to perceive a CAPTCHA (for example, due to a disability or because it is difficult to read) will be unable to perform the task protected by a CAPTCHA.

Prevent Spam Attacks without Using CAPTCHAs

The idea here is setting up a form with a text field which is made invisible by using CSS. After form submission, if that text box has information in it, that means a human didn’t fill it out (because this field is invisible for humans), and the submitted form is simply aborted.

Here are the steps for implementing the methods mentioned above:

  1. Add an input field to your form, with some interesting name, for example 'URL', or 'Subject'.

    <input name="subject" type="text" value=""/>

  2. Make the input box invisible using CSS so that human users cannot see it directly.

    <style type="text/css">
       .fstyle
       {
           display: none;
        }
    </style>

     <p class="fstyle"><input name="subject" type="text" value=""/>  </p>

  3. After submission, check the invisible input. If it contains any value, reject the post.

Conclusion

I implemented this method, in a high traffic blog site, the site was catching around 50 spams a day without any spam prevention methods. With this invisible form input method, the site receives 2-3 manually entered spam messages.

Want automatic updates? Subscribe to our RSS feed or
Get Email Updates sent directly to your inbox!

Currently rated 4.3 by 7 people

  • Currently 4.285715/5 Stars.
  • 1
  • 2
  • 3
  • 4
  • 5


Comments

October 20. 2009 20:23

Maybe it's a good trick, but what about the accessibility? without the stylesheet the input will be seen by the user or there's something I miss?

Elmook | Reply

October 21. 2009 12:01

@Elmook
you can use inline style, but it won't work if user disables css in his browser (and I don't know anyone who has css disabled)

pauk960 | Reply

October 22. 2009 12:14

Just wanted to let you people know that this method is called the honey pot... I'm writing an article about it at this very moment.

Paul Olyslager | Reply

October 22. 2009 20:18

This is an interesting idea but there seem to be too many points of failure. What If I'm visiting your website with my mobile device and it's not properly displaying CSS? Still, I think it's on the right track.

Jeff Walden | Reply

October 25. 2009 21:55

You can always put a label "don't fill this value" along with the field, and set that to display: none too.
Even with disabled or messed up CSS the user will do the right thing Smile

MartinodF | Reply

October 26. 2009 19:16

This is the best solution IMO... and there is a way to make sure you're following best practices:

<input name="subject" type="text" value="Spam Control. Do Not Change."/>

OR

You could add a label or paragraph describing its use to browsers with no CSS enabled or problems rendering the site.

It may add some "WTF 'ness" to the 1% users who have issues rendering css, or have css disabled, BUT they're being taken care of by informing them of the reason of the extra input box.

Oh and I would adivse on having two of those. One with a name of "Subject" and one with a name of "3D3fG5ed5S" (gibberish), as some bots actually bypass honeypots like this based on their name.

Jaime | Reply

October 27. 2009 11:58

This would only help for generic spam bots, since any spam bot, written to spam specific resources, can still succeed. Besides, if this practice spreads, bots will just check for fields like that.

Anton | Reply

November 3. 2009 00:52

Regarding the issue of those with CSS turned off, I've been thinking that, for them, you could have a message saying "type the result of 2 plus 2 here" or something like that, and set the form field to accept either no input or 4. etc...

Ralph | Reply

November 12. 2009 11:09

Obviously, if this became popular spammers would just modify their scripts to process CSS and not alter boxes that wouldn't be shown to the user.

Chad Okere | Reply

November 12. 2009 16:00

Or simply use a catcha then...

For normal user use this better method, and for thoses that do not want CSS (or can use it), use catcha.

I think that another trick would be to require user interraction to submit the form and do not use a standard "submit" and form.

Visitor | Reply

November 13. 2009 11:05

I tried this technique on my website and it finally didn't work.

Why ? Because spam bots are getting clever and parse css like your browser. Finally, they didn't see the vicious input and act like everyone would act.

If you don't want to add a captcha system, you can use Akismet.

cx42net | Reply

November 13. 2009 20:23

How about, humans that send the form then press back, and send the form again?
I use the catcha for people not for robots

Chocolim | Reply

November 14. 2009 01:42

There are many methods that seem a little arduous but don't, in any way, prevent the user from unnecessarily filling out input data they are not required to...

A user generally fills out details for the forms intended use, and by inserting additional methods that have no intended use for the user, but sole dependence to prevent the website from receiving spam.

I have conjured a reasonable method, without the users additional efforts. Simply by passing a randomly generated (but in a unique way) string as the hidden input NAME, not value. But the value itself carries a unique key that is in an array of keys generated at the beginning of a session. This way we can validate what’s being changed from what is set, and what is being changed by the user. Although in this case the user cannot change the value since it’s an hidden input. This method has been applied to 3 different high trafficked commercial websites… and not a single spam message has been received Smile

This may create a little extra work for a developer, but it solves the quest of allowing the user to carry out useless methods to help the website, but meaning nothing to them. If anyone is unclear perhaps interrogate me and I’ll be happy to explain.

Cue | Reply

Add comment




(Will not be displayed!)








Free CMS