Comments on: Dealing with Automated Form Submission (Spam)

By: Day 7: Don’t rely on client side validation - The Ramblings of Ryan Lahay

Day 7: Don’t rely on client side validation - The Ramblings of Ryan Lahay — Thu, 16 Jul 2009 19:23:38 +0000

[...] of methods to detect if an entry is not human (ie: how long it took to fill out the form, the honey-pot method, etc) that we could do away with forcing users to fill in a Captcha. If the entry fails all the [...]

By: Andy H

Andy H — Tue, 23 Sep 2008 05:09:28 +0000

Genius! This is a perfect way to separate yourself from the easy, “low hanging fruit” that the Form-Bots seem to go for.

The problem is, if everyone was as proactive as you, there would be no more low-hanging fruit and the Form-Bots would have to get smarter!

By: Andrew Wooster

Andrew Wooster — Fri, 12 Sep 2008 09:09:31 +0000

I came up with a site-specific captcha that has pretty much eliminated spam comments on my blog: http://www.nextthing.org/archives/2005/07/16/a-few-upgrades

The only ones I still get seem to originate from manual-labor spammers in India (I can tell from the IP addresses), and the occasional referrer spam which usually gets caught by Akismet.

By: Ole Morten

Ole Morten — Fri, 12 Sep 2008 07:33:37 +0000

On my blog I stop accepting comments 2 weeks after a post has been published: http://www.omh.cc/2008/may/24/how-do-you-fight-spam/

By: Fíam

Fíam — Fri, 12 Sep 2008 07:22:58 +0000

Check the method I implemented some time ago http://fi.am/entry/preventing-spam/. It doesn’t require javascript and my comment spam went from hundreds a day to one in almost four months.

By: zgoda

zgoda — Fri, 12 Sep 2008 07:21:41 +0000

Similar measure is implemented in new comments framework in Django. I wasn’t sure if this has any preventive value, but if you say so…

By: rasiel

rasiel — Fri, 12 Sep 2008 03:31:43 +0000

i’ve been having a similar problem with a newsletter submission form (where the user signs up for a newsletter). I will either have to implement one of your methods above or have an authentication method where an email is sent to their email address and the click on a token to authenticate.

Automated bots seem to be a big problem now, what i don’t get is why would they submit to a newsletter form with only name and email address?