How to Prevent SPAM without CAPTCHAs or a Centrall

Question

Has anyone been able to successfully prevent spam on their site without placing a burden on your visitor (e.g. CAPTCHA) and without using a centralized spam reporting system (e.g. Akismet)

I've found this & it looks promising, but doesn't contain detailed deployment instructions.

I want to present my web forms without burdening my users with CAPTCHA like technologies, but also actively automate preventing spam.

There doesn't seem to exist a detailed instruction/tutorial on how to implement such a technology.

Disclaimer

Also, I realize there no silver bullet appropriate to preventing spam. But if simply putting in place a non-invasive (invisible to user) prevention system that blocks 95+ % of spam, it would be worth the effort to deploy.

Answer 1

I basically use one trick on my site to prevent Spam and it works great (at least until spambot programmers will read this post ;) ).

Code is like this:

In the script that builds the site which contains the form, I implemented:

$_SESSION['lastSiteId'] = 'something Unique';
$_SESSION['lastSiteRequest'] = time();

The script that contains the logic to write the comments to a database contains this:

if($_SESSION['lastSiteId'] == 'something Unique' 
   && $_SESSION['lastSiteRequest'] + 5 < time()){

    insertComment();
}else{
    echo "Please read the article before posting a comment";
}

Remember this is pseudocode to give you the idea. You have to implement it all alone in the end... ;)

All it does is checking if more than 5 seconds have passed between redering the form and sending a POST Request.

Be warned that spambot engineers are not sleeping. Bets are, that spambots can wait a few seconds before posting unwanted input if the programmer wants it that way. Question would be: How much spam messages can be send if the Spammer have to wait 5 secs between the requests? See, maybe this IS the final solution to Spam prevention.

Combining time tests with javascript tests (if possible and wanted) plus prefilled/unfilled hidden fields tricks, you should be save from spam a few years from now on.

Answer 2

If there were an ultimate solution, there would be no need for CAPTCHA's at all. However if the size of your site isn't large enough to warrant someone manually looking for a way to hack it, security through obscurity may be the best way. Such as the link you supplied above, or as easy as adding a input called something like "City_2" and making it hidden. If the input box is filled out, chances are you've got a spammer as they automatically fill in every field- just dump the data and move along... Just my 2 cents.

Answer 3

This is a very good working solution, I using it in my projects.

It's worth a try...

Answer 4

In your form (comments or also contact form) you should add an hidden input

<input type="text" id="hidden_input" name="hidden_input" style="display:none;"/>

and write a little php to check if this input is filled, so with a selection 'if than else' you can control

if($_POST['hidden_input'] != ""){
    echo('<p>You are a spambot!!!</p>');    
}

This because people can' t see this form, so can' t be filled by us. In this way indeed bot fill every input, so if every input is fill PHP send this error message and it doens' t send to the server comments or emails,

Answer 5

Honey Pot captcha (article by Phil Haack). Is the usual method employed to do what you are looking for. It isn't foolproof, but what is really?

This appears to be pretty much what you have already explored. Just do your due diligence to understand what the limitations of the solution are, if you still find it meets your needs, be assured this technique has been put to good use by others.

Answer 6

I use Akismet, which is really just very similar to an email spam filter, but quite powerful as it continuously builds a Bayesian profile with the combined spams of every site using the service (about 18 million comments per day). Their web service is extremely simple and very fast - just sent the comment over the wire and they will send back a "spam" or "not spam" response. There are existing Akismet libraries for almost every platform.

On my site, if the comment passes, I put it in the database, otherwise I just silently ignore it.