Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

If I were to generate my field names randomly each time a contact form was rendered, would that help prevent SPAM bots from recognizing the fields? Can they read label text?

share|improve this question
add comment

1 Answer 1

It will help but it won't prevent it from stopping all spam. The changing name fields, assuming they are unique every time the form is displayed, will help stop the bots that depend on knowing the form fields ahead of time to complete the form. It will also help stop the bots that look for exact field names like "name" and "email", etc.

What it won't stop are bots that are smart enough to look for field names that are like common field names but not always exactly the same. They look for fields that contain common field names like "name" and "email". So if your form uses those identifiers inside of your dynamic field names they will still get through. Your idea also won't stop human spammers at all. They'll just fill out the form and submit it without any difficulty at all.

If you want to stop bots, these are some options you can implement along with your dynamic field names:

1) Putting a fake field that only bots will see. Then if that field is submitted with the rest of the form you can ignore it (and ban them if desired). You can also trap bad bots who follow a hidden link.

2) Use a CAPATCHA like reCAPTCHA

3) Use a field that requires the user to answer a question like what is 5 + 3. Any human can answer it but a bot won't know what to do since it is auto-populating fields based on field names. So that field will be either incorrect or missing in which case the submission will be rejected.

4) Use a token and put it into a session and also add it to the form. If the token is not submitted with the form or doesn't match then it is automated and can be ignored.

5) Look for repeated submissions from the same IP address. If your form shouldn't get too many requests but suddenly is it probably is being hit by a bot and you should consider temporarily blocking the IP address.

6) Use Askimet. It is great at identifying spam.

share|improve this answer
    
Thanks John. What if the field names are completely random alphanumeric strings? (Such as 8f532GH1.) –  Belmonster Aug 25 '11 at 13:32
    
That will stop the bots that look for common field names for sure. –  John Conde Aug 25 '11 at 13:33
    
Also, can the amount of time it takes between the form page being shown and the action page being accessed be a potential check? (If I'm correct, wouldn't a bot be able to submit instantaneously, where a human would take longer?) –  Belmonster Aug 25 '11 at 13:35
    
That is good in theory but it's hard to say how quickly someone can fill out a form. If you keep the timeframe short, say no more then three seconds, then I would think you wouldn't affect a human who was submitting a form. Anything that can potentially stop a human from filling out the form is always something that really needs to be thought out as you never want to turn away real users no matter how bad spam gets. –  John Conde Aug 25 '11 at 13:38
    
Thanks again! I also found your response to: webmasters.stackexchange.com/questions/3588/… to be really helpful in understanding how they work. –  Belmonster Aug 25 '11 at 13:42
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.