Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Possible Duplicate:
How can I prevent spam on sites which I control?

ReCaptcha is all the rage at the moment,

Based on customer/user feedback, what other captcha or general human verification tools have you used for your website?

Links to the API/Site appriciated,

Thanks guys!

share|improve this question

marked as duplicate by danlefree Feb 16 '12 at 0:31

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

add comment

8 Answers

I like to use Honeypots in my forms since the user won't notice them, they keep most crap away but are not 100% foolproof. The trick is to make a new form field in your existing form, for example <input type="text" name="email" id="mailfield"/> and put #mailfield { display: none; } in your CSS. If your form is submitted with data in the email field you can be pretty sure it's a bot and discard the message.

share|improve this answer
    
I love this method, it is so simple to implement and really effective. –  DisgruntledGoat Jul 12 '10 at 19:59
    
Wouldn't all the decent bots have adapted to this method by now? –  Casebash Jul 13 '10 at 23:13
    
@Casebash It's possible that some bots could outsmart this method but they would definitely be considered the exception and not the norm. It's generally safe to say that the majority of bots crawling for spam are stupid. –  Evan Plaice Jul 15 '10 at 0:56
add comment

Use a combination of timestamp, spinner, field names, and honeypots...

Read this article for the detailed example.

A timestamp is exactly what it sounds like. A hidden field that marks the time when the form was originally opened. This defeats playback bots that copy a form and replay back the submission process over and over with different data each time. If the timestamp isn't close enough in relation to when the form is submitted the submission is automatically rejected.

A spinner is a hash using data from the timestamp, IP address, entry ID of the article, and a secret.

Field names are all generated by applying the hash to the 'real' field names. By comparing the field names with the spinner during the post-processing stage you can verify whether the person/or bot is the same as the one who originally opened the form.

The Honeypot has already been explained by @D4V360. It's essentially a hidden field that acts as an invisible trap for bots. If it's filled in with data then the form is automatically rejected.

share|improve this answer
    
I don't usually like to rely heavily on an article for an answer but this one is too in-depth to briefly summarize. It's definitely a good read. –  Evan Plaice Jul 12 '10 at 17:30
add comment

I like low-tech: Doing a simple math problem works well.

Enter what 4 + 4 adds up to:

Then check server-side for 8.

This is one I've used successfully on blogs using the Math Comment Spam Protection Plugin.

Adding an extra field to your forms like:

<input name="bots_only" value="" style="display: none" />

Usually, if bots_only is passed along with a value then you've got a bot. Though browsers without CSS will see that field, if you place it after your submit button it should get ignored even if it is for some reason visible.

share|improve this answer
    
+1 Yeah, low-tech captchas also are quite useful. –  Dave Dec 22 '10 at 16:13
add comment

I've also used simple natural language challenges, such as :

A ________ is something with numbered pages surrounded by two covers.
Hint: Rhymes with look

The caveats of this approach is having to maintain a separate challenge/hint/answer file for each language that you want to support, but I'm leaning in this direction more and more as CAPTCHA images become increasingly harder to read for some people. My wife, for instance wears heavily corrective lenses and gets extremely frustrated when she fails the 'human check' several times, even when the site is using RE-CAPTCHA.

Challenges in plain text also have the benefit of changing as users set accessibility controls to their liking.

The only requirement for the visitor is an elementary degree of literacy, so this might not work on sites like YouTube or Yahoo Answers.

share|improve this answer
2  
On the contrary, it may make the comments less cringe worthy –  Casebash Jul 13 '10 at 23:12
add comment

Captcha2 is another alternative. It works by clicking three letters following instructions on screen. Not sure how this stands up to internationalisation. It's also not free after the first 1000 impressions. If you're after something a little more light hearted then KittenAuth is interesting - click 3 kittens to continue. Finally, to see how captchas are standing up to automated cracking take a look at the PWNtcha site. It has an open source solution for cracking captchas along with details on the toughest types.

share|improve this answer
add comment

One thing that it's worth noting is that more and more spammers are using real people to do their work, rather than bots. In which case, worrying about which captcha or honeypot to use isn't going to be very useful.

share|improve this answer
add comment

I have only administered one forum, which is phpBB-based. Recaptcha was a godsend, instating it for user registration and unregistered posts reduced spam to a fraction. Additionally we still use a blacklist filter which does keep out some remaining spam but may be more annoying than helpful.

share|improve this answer
add comment

I use Ads Captcha. It's neat, simple and effactive, but more than that: it uses Ads as the captchas. So everytime someone comments, i make money. it's a great benefit, since i'd use some captcha anyway. in spam prevention manners: it reduced my spam to 0.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.