Spam Prevention/Reduction - Contact Form ?

Question

Hi

I want to add a simple Contact form to my web site so that customers can contact me easily.

<form>
    NAME
    <input type='text' name='name' />
    EMAIL
    <input type='text' name='email' />
    MESSAGE
    <textarea name='message' />
    <input type='submit' />
</form>

This form would simply email me the customers message.

But, I also want to reduce (not, I'm not saying eliminate but at least reduce), SPAM.

I've looked into using CAPTCHAs but, ultimately, I don't want to hinder the customer with having to fill out extra information.

Any ideas of a good simple spam prevention/reduction method I could use for my Contact form.

Answer 1

1. When processing check the users headers, however most bots provide headers.
2. Try and resolve the IP provided; if it resolves and provides a web page you can assume it's being sent from a server, therefore the chances of it being a bot are high.
3. Have a question, for example "what is the name of this website?" or "What is 5 + 2?", however bots can bypass these quite easily.

I would personally recommend a combination of the above: When the form is submitted check the users headers + see if the IP is a webserver and if either are true, present captcha. However if this was me I'd just implement recaptcha it's a great service, pretty much 100% secure and very easy for end users, I love it.

Answer 2

You can just log IP ($_SERVER['REMOTE_ADDR']) and forbid re-validation with this IP during 1 minute or, more precisly, start a session, give an ID no you visitor and forbid re-validation for 1 minute (or more but bot don't like to wait).

Answer 3

Use Google or Yahoo mail account. They have good anti-SPAM filters.

Answer 4

The only (client-side) way other than a CAPTCHA type user confirmation would be to write the whole thing dynamically. A lot (but not all) of robots would probably ignore the dynamic content. Eg

document.write("<"+"form>"
  +" NAME "
  +" <"+"input type='text' name='name' /> "
  +"EMAIL "
  +"<"+"input type='text' name='email' /> "
  +"MESSAGE "
  +"<"+"textarea name='message' /> "
  +"<"+"input type='submit' /> "
+"<\/form> ");

Answer 5

A very simple trick I've been using with a surprisingly good success rate is this: Provide a text field that is hidden from human users with style="display: none", but with an enticing name like email. Most bots will fill in something in this field, but humans can't see it so they wont. At the server, just make sure the field is empty, else treat the submission as spam.

Answer 6

You won't need to reduce spam cause the messages are not published on the website. A lot of spam is posted on forums and blogs because this will reach a large audience of viewers and bots.

For a private contact form, spam is ineffective, so you won't have to worry about large amounts. The few spam messages that you will receive can effectively be filtered with a spam filter on your inbox (for instance using gmail or yahoo), especially since the incoming messages are plain text without images.