Spam Prevention/Reduction - Contact Form?

I want to add a simple Contact form to my web site so that customers can contact me easily.

<form>
    NAME
    <input type='text' name='name' />
    EMAIL
    <input type='text' name='email' />
    MESSAGE
    <textarea name='message' />
    <input type='submit' />
</form>

This form would simply email me the customers message.

But, I also want to reduce (not, I'm not saying eliminate bu开发者_StackOverflow中文版t at least reduce), SPAM.

I've looked into using CAPTCHAs but, ultimately, I don't want to hinder the customer with having to fill out extra information.

Any ideas of a good simple spam prevention/reduction method I could use for my Contact form.

A very simple trick I've been using with a surprisingly good success rate is this: Provide a text field that is hidden from human users with style="display: none", but with an enticing name like email. Most bots will fill in something in this field, but humans can't see it so they wont. At the server, just make sure the field is empty, else treat the submission as spam.

If you want to do a completely front-end solution I have had success recently by leaving the form action attribute blank, and populating it via a $(document).ready function. Most spambots use a browser that has javascript disabled, or are looking for hidden fields to avoid detection.

Example:

Your html would be:

<form method="POST" action="" id="contact-form">

and anywhere in that page you can use this to populate it.

<script>
        $(document).ready(function(){
                 $("#contact-form").attr("action", "/yourMailScript.cgi");
        });
</script>

A bot browser with no javascript will not get a form action, and they will get a 404 upon submission. Anyone with a normal browser (unless they have JS disabled for paranoid reasons) will get the normal behavior.

The only (client-side) way other than a CAPTCHA type user confirmation would be to write the whole thing dynamically. A lot (but not all) of robots would probably ignore the dynamic content. Eg

document.write("<"+"form>"
  +" NAME "
  +" <"+"input type='text' name='name' /> "
  +"EMAIL "
  +"<"+"input type='text' name='email' /> "
  +"MESSAGE "
  +"<"+"textarea name='message' /> "
  +"<"+"input type='submit' /> "
+"<\/form> ");

Use Google or Yahoo mail account. They have good anti-SPAM filters.

Hidden fields, silly questions (what is 3+4?), etc, are not very effective at blocking spam on forms, IMHO.

I researched this several years ago, and came up with a solution I call "FormSpammerTrap". It uses JavaScript code to 'watch' for focus/onclick on required fields. Automated processes, unless highly customized for a specific site (which takes more time than spambot owners want to take), can't 'focus/onclick' a required field. (And there are some other techniques I use.)

I have a free solution at my www.FormSpammerTrap.com site. And there's a form there that spambots can try to spam...and they haven't, for more than 3 years. You are welcome to try it out...it's all open source, so you can see how it works. (And, if you use the form, I don't harvest your email. I reply once, then delete your email.)

My technique is much more effective in blocking spambots, IMHO. They haven't been able to spambot the contact form on that site.

**Added 12 Jul 2018 ** The trick is to add an on-click/on-focus event that changes the action parameter to the actual processing page. Otherwise, the default value I use is a honeytrap-type site. I think it's hard for a spammer to simulate those events, although possible perhaps. The technique blocks a lot of bot-spammers.

And still, after a couple of years using the technique on that site, the form hasn't been spammed by bots. (I define a bot spammer that sends multiple submits via the attack, not just one submit.)

Works for me.

You can add simple question, each serious person who wants to contact you, can easily answer. For example a field where he should enter the first letter of the domain. Most bots don't understand the question and will enter nothing or something random.

You could also try to track the time how long the user needs to input data. If he tries to send the form earlier than 5 seconds before typing the first word just don't allow to send it. Bots usually just parse the site, fill out everything and then post it and go to the next website.

#sec {
  visibility: hidden;
  padding: 0;
  margin: 0;
  height: 1;
}

<form method="POST" action="www.google.com">
  NAME
  <input type='text' name='name' />
  <br /> EMAIL
  <input type='text' name='email' />
  <br /> MESSAGE
  <textarea name='message' /></textarea>
  <br />
  <input type='text' name='security' id='sec' placeholder="Do not enter anything here" />
  <input type='submit' formaction="" />
</form>

**Here, only a user who clicks on the submit button actually could submit the form. using auto submit simply redirects the bot to google.com. **

*Also the input 'security' is an input field that is hidden to users, and visible to certain bots, known commonly as HoneyPot Captcha. On the server side, you can simply skip all the requests that has the 'security' field filled. Not every bot can be tricked this way, and this is where the attribute formaction comes into play *

grep for URI methods, urlencoded characters, or the two HTML markup characters, seems to work.

Use an anti-spam API like Akismet or Cleantalk. You can use the traditional checks for less sophisticated bots before hitting the API. An anti-spam API is the only way to catch spam submitted by a human.

I think that nowadays, most of the solutions posted are either inefficient or outdated.

1. reCAPTCHA is not a hassle for users any more

google documentation

reCAPTCHA v3 returns a score for each request without user friction. The score is based on interactions with your site and enables you to take an appropriate action for your site.

OP states that he needs an alternative to CAPTCHA, in order to avoid hassle for his users (up to v.2, reCAPTCHA requires user interaction). However, as of v.3, reCAPTCHA can detect bots "silently", without requiring user interaction.

2. Front-end-only solutions are inefficient

The honeypot (hidden input that only a bot could fill) and simple questions methods, as well as other front-end implementations, are still vulnerable to spam attacks. First of all, the spammer can bypass all front-end and post directly to the server. Therefore, a server-side check is required.

In addition, if someone wants to spam your site, specifically, he can easily read your source-code and build a script that is "clever" enough to not be caught by the front-end protection.

On the other side, reCAPTCHA v.3 tracks data and works behind the scenes, in Google's back-end, to determine if the user is actually human. Its logic is hidden, therefore, the attacker can not easily develop a "smarter" bot. In addition, the attacker can not just bypass the front-end; a token is created, is passed server-side and then to Google's back-end to be validated.

TL;DR

Nowadays, reCAPTCHA seems to be the best solution in all aspects. No user friction and the most secure.

Use JS technology. Like if a user comes on your contact page then javascript will generate a string or anything like that you prefer and put the information on a hidden text field. But it is not the actual solution, smart bot can easily crack it.

Another way is, You can also use email verification after contact form submission. And store the data on your database. If customer verifies the url through email then the contact information will mailed to you from database.

And also use delay to prevent continuous robot attack. Like sleep() in PHP code. This will add few delay in your code. By this way you can reduce random attacks but this is not the prevention method.

I found a nice idea on this page:

http://www.evengrounds.com/developers/alternatives-to-captcha

You can make your SUBMIT button display a confirmation page, on which you explain to user that he has to hit CONFIRM button to actually send a message. Spambots would usually only submit first form and skip the second step.

If you dont want to use recaptcha then you can use a service like Real Email and validate the emails server side before processing. Keep in mind that your probably want a way to report to the user if there is something wrong with the input.