Good Form Security - no CAPTCHA

Question

Is there a good method of form security that does not involve CAPTCHA? CAPTCHA is so annoying, but I need security because I am getting form spam. My form is PHP.

Answer 1

Math questions are interesting alternative. You can even write your own simple math checker by using random numbers.

Here are couple of plugins:

http://www.codegravity.com/projects/mathguard

http://sw-guide.de/wordpress/plugins/math-comment-spam-protection/

Answer 2

Try askimet. It's great at flagging spam. The API is easy to use and completely transparent to your users.

Answer 3

Here's what I've found to be very effective (and dead simple):

1. Put a hidden field on your form. Give it a name like "phone" or something similar/common and put in a default junk value.

2. Put another regular text input field on your form, but hide it with CSS. Make that one empty. Again, give it a "real" sounding name (first_name, phone_number, whatever).

3. When the form is posted, verify that the hidden field still has the default value and the field you hid with CSS is still empty.

You're basicly taking advantage of the fact that most spam bots will simply fill in every field in the form in order to avoid failing any required field validation checks. Some might be smart enough to ignore hidden fields, but I've never seen one that was smart enough to ignore fields hidden with CSS.

ETA: To address some comments - Is this a truly "secure" system? no, it certainly isn't. It would be trivially broken by anybody who wanted to specifically target your site. That said, it is still remarkably effective against the automated form spamming bots that most "low value" sites will see.

If you want to stop a determined attacker, you'll need something a bit more invasive. Another poster mentioned Akismet, which is a good option. Re-Captcha would be another. Stopping determined, targeted spammers is hard though. Even Yahoo and Google have a hard time with it.

Answer 4

Depends on the type of form spam, general bots made for spamming any form it finds can easily be foiled by a lot less obstructive measures (like "what is the name of this site?"), but if someone has made a bot targeting your site specifically you will need captchas or something equally annoying.

Answer 5

If all you are doing is avoiding spam bots (automated programs that seek <form> tags, fill in all <input> fields, then submit the form), then a simple solution is to do as Paolo said: use JavaScript to add a hidden field. The disadvantage is for people who disable JavaScript.

Feel free to use this:

<form method="post" action="contact.php" id="commentForm">
  <label for="name">Name</label>
  <input type="text" name="name" id="name" maxlength="64" /><br />

  <label for="email">Email</label>
  <input type="text" name="email" id="email" maxlength="320" /><br />

  <label for="message">Message</label>
  <textarea name="message" rows="10" cols="40" id="Message"></textarea><br />

  <label for="human">40 + 2 =</label>
  <input type="text" name="human" id="human" size="10" maxlength="3" /><br />

  <p align="center">
  <input type="submit" name="submit" value="Send" class="submit-button" />
  </p>
</form>

Then place the following as "contact.php" in the same directory:

<?php
require_once 'lib/swift_required.php';

// Reason for not contacting.
//
$reason = 'default';

error_reporting( 0 );
ini_set( 'display_errors', 0 );

function not_contacted() {
  global $reason;

  header( 'Location: error.html' );
}

function wms_error_handler($errno, $errstr, $errfile, $errline) {
  not_contacted();
  return true;
}

function wms_shutdown() {
  if( is_null( $e = error_get_last() ) === false ) {
    not_contacted();
  }
}

set_error_handler( "wms_error_handler" );
register_shutdown_function( 'wms_shutdown' );

$name = trim( $_POST["name"] );
$email = trim( $_POST["email"] );
$message = trim( $_POST["message"] );
$human = trim( $_POST["human"] );
$subject = 'FormSpam';
$contacted = false;

if( is_null( $name ) || empty( $name ) ) {
  $reason = 'name';
  $human = false;
}
else if( is_null( $email ) || empty( $email ) ) {
  $reason = 'email';
  $human = false;
}
else if( is_null( $message ) || empty( $message ) ) {
  $reason = 'message';
  $human = false;
}
else if( is_null( $human ) || empty( $human ) || $human !== '42' ) {
  $reason = 'computer';
  $human = false;
}

if( $human === '42' ) {
  $subject = 'YourCustomSubject - '.$name;

  $transport = Swift_SmtpTransport::newInstance( 'localhost', 25 );
  $mailer = Swift_Mailer::newInstance( $transport );

  $message = stripslashes( $message );

  $message = Swift_Message::newInstance()
    ->setSubject( $subject )
    ->setFrom( array( $email => $name ) )
    ->setTo( array( 'YourEmailAddress' => 'Your Name' ) )
    ->setPriority( 1 )
    ->setBody( $message )
  ;

  if( $mailer->send( $message ) ) {
    header( 'Location: contacted.html' );
    $contacted = true;
  }
}

if( $contacted === false ) {
  not_contacted();
}
?>

Should prevent 99% of spam.

I have not added constants, but I'm sure you can figure out where to change the script. I've removed the part where it redirects to different pages depending on what was (or was not) entered by the user (e.g., missing full name, e-mail address, message, and such). If you want a full version of the script, let me know and I'll fix the code to be more new-developer-friendly.

Note the Swift Mailer dependency.

Answer 6

This kind of validator is cute and quick!

Obviously, you will want to display one of a many possible animal images, and the list should be randomized as well.

I understand it will only work X% of the tim, but adding more options to the list will help reduce spam.

Answer 7

If the time to submit the form was inhumanly fast, then it likely was not a human.

Answer 8

Consider Greylisting.

Answer 9

I have already worked something similar.

1. When you open a form generate one md5() string and put it in session (for example $_SESSION['captha'])
2. Your form sould have one hidden field and when you open this form write this data from $_SESSION['captha'] into this hidden field
3. When you receive this post request compare value in session and value which come with this hidden field. If it is same everithing is ok and vice versa. Of course, after you handle this request just delete variable $_SESSION['captha'].

This work for me.