Pre-defined (canned) contact form messages on your website

Question

I want to know what you guys think of having a contact form on your website with a few pre-defines (canned) messages on your website. I am talking here about a personal website, like a portfolio website.

I want to lower the steps you have to take to get in contact me, make it easy for people to send a small massage. I was thinking of something like this.

Start with an email box, that is required to fill in. After that a name, not required.

Then have 2-3 messages says:

1)Hi, I just want to say hi;

2)Hi I have a job for you!;

3) etc;

4) of course having the option for a custom message.

Your visitor just has to click the message, and it will be emailed.

===
Security:
I also want to remove the captcha. Just store the IP of the user, and the user can only send 1 message. If the user wants to send another messages then the captcha will popup.

====
Cross-browser.
If people have older browsers and the javascript system is not supportant, then there us just a normal contact box.

What do you think of this, are there any problems you can run into?

Answer 1

This is a good idea as making a form easier to use can only increase user activity. Making the form cross-browser really should always be done, not just for forms or JavaScript. Basically any public facing web page should work in every browser with or without JavaScript enabled.

For security, removing the CAPTCHA is definitely a good idea as they only hinder users and spammers can easily bypass them. But your idea about IP address checking will have very limited success as spammers can easily change IP addresses. I would add other preventative measures to catch the spam before it can be sent. Examples would be:

• Putting a fake field that only bots will see. Then if that field is submitted with the rest of the form you can ignore it (and ban them if desired). You can also trap bad bots who follow a hidden link.

• Use a field that requires the user to answer a question like what is 5 + 3. Any human can answer it but a bot won't know what to do since it is auto-populating fields based on field names. So that field will be either incorrect or missing in which case the submission will be rejected.

• Use a token and put it into a session and also add it to the form. If the token is not submitted with the form or doesn't match then it is automated and can be ignored.

• Use Askimet. It is great at identifying spam.