Blocking spam in a PHP site without bothering the user.

Question

I'm currently working on a little chat/forum site that I roughed out in a weekend, and it has anonymous entries (i.e.: no usernames or passwords). This looks like it could be easy-cake for a spammer to ruin, but I don't want to bother the user with captchas or similar anti-spam inputs.

Are there any invisible-to-the-user alternatives to these? Thanks for your help.

Answer 1

Not a bomb-proof solution, but you can have some hidden input fields. If those are not left empty, you caught a bot. Bots tend to fill all input fields, while users will sure leave fields they don't see empty.

Answer 2

The idea of capchas is that they are very easy for humans to pass but very diffucult for bots etc. to avoid. If you don't want this kind of solution what will keep those spam-bots from posting to your site?

It's like you would like your computer to be safe but you don't want to use an antivirus and firewall.

I think you could create a session for every user that enters your site and first time they want to post something show them the capcha (don't require to log in, just pass capcha). If they pass it just store a flag in session that they are human. As long as they have their browser opened they can post and reply on your site what they want. Bots will unlikely pass this first test.

Answer 3

There are two classes of anti-spam protection.

The first is to make it difficult for automated bots to stumble data into your site. The hidden form field method is frequently mentioned for this, and is suitable for low traffic sites. These protections can be trivially defeated by a spam bot written for your site. However if you are too small a target, this won't happen.

The second is the "bothersome" types. This usually involves a captcha, registration, or email confirmation of post. You can use a few approaches to make this less bothersome, but requires much more effort on the bot's side to post spam.

Note that both of these approaches can often impede disabled and mobile users.

Answer 4

This has worked 100% of the time for me:

<input type="text" style="display:none" name="email" value="do not fill this in it is for spam catching" />

Then server side (PHP):

if($_POST['email'] != 'do not fill this in it is for spam catching') {
    // spam
}

As mentioned earlier, most bots fill everything in, especially inputs named "email".

Answer 5

One thing you should know about spammers is they always go for the low-hanging fruit. Same with hackers. By this I mean they'll pick the easiest to hit targets that affect the most users. This is why PHP and Windows vulnerabilities are often exploited: they affect so many users that if you find such a weakness/exploit your target "market" is huge.

It's also a big part of the reason why Linux and Mac OSs remain relatively unscathed by viruses for example: the target market is much smaller than Windows. Now I'm not equating the security and robustness of Windows with Mac/Linux but even though the security model of the latter two is much better the number of attacks against the former is still disproportionate with the deficiencies it has.

I say this because one of the best ways to avoid these kinds of problems is not to use popular softare. phpBB for example has had lots of attacks made against it just because it's so popular.

So by doing your own chat/forum system you're at a disadvantage because you have a system that doesn't have the field-testing something popular does but you also have an advantage in that it isn't worth most spammer's time to exploit it. So what you need to watch out for is what can automated systems do against you. Contact forms on Websites tend to have recognizable markers (like name, email and comment fields).

So I would advise:

• Ignoring responses that come within say 5-10 seconds of sending the form to the user;
• Using a honeypot (CSS/JS hidden fields as described elsewhere);
• Using Javascript where applicable to render, reorder or display the form;
• Using non-predictable form field names; and
• Throttle bad responses by IP.