The best spam filters will not notice your visitor. The worst costs you apply for.
You stop form spam with a honeypot field that people don't see but robots fill in, a time control that rejects submissions that are too fast, and a limit on the number of submissions per address. These three together capture the vast majority, without a visitor noticing anything.
STEP BY STEP
In this order
- Add a honeypotA hidden field that people don't see and don't fill in, but automated scripts do. If it is completed, you reject the submission. Costs nothing and catches a lot.
- Measure the completion timeA form that is sent within two seconds of loading has not been completed by a human. A simple time check filters them out.
- Limit the number of submissionsMaximum a few entries per address per minute. This stops volume attacks without a normal visitor noticing.
- Validate on the server sideChecks in the browser can be circumvented. What counts is the control on the server, because that is where the submission actually comes in.
- Only when necessary: a challengeIf spam continues to come through, then a captcha. Start with a variant that doesn't charge most visitors anything: puzzles with traffic lights demonstrably cost requests.
PITFALLS
What your conversion costs
A heavy captcha as a first measure is the classic too-much-of-a-good thing. You stop spam and some of your real requests as well.
Placing an e-mail address unprotected in the source code also results in spam. That is a separate cause that has nothing to do with form security.
- Honeypot first — invisible and effective.
- Time control — people don't type in two seconds.
- Validate server side — browser controls can be bypassed.
- Captcha last — each puzzle costs an application.
- Email address not flat in the code — separate source of spam.
FREQUENTLY ASKED QUESTIONS
More about spam
Does a honeypot really work?
For the vast majority of automated spam, yes, and it costs your visitor nothing. It does not help against targeted manual spam, but that volume is usually small enough to handle manually.
Should I use reCAPTCHA?
Preferably not as first choice. It costs applications and adds a third party that you must mention in your privacy statement. Start with the measures that your visitor does not notice.
I'm suddenly getting a lot of spam. What now?
First check that your form has the measures above and that your email address is somewhere unprotected in the code. In most cases it is one of those two.
CONTINUE READING
Of course, continue reading about this subject.
Forms that work?
We build forms with spam filters that your visitor will not notice and that will not cost you your requests.