Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am really curious about how to prevent comment spam in a forum using a honey pot trap for spam bots.

  • What if CSS and javascript is turned off in a browser?

  • Do you see any other disadvantages in the honey pot trap?

  • What do you think every honey pot trap should have?

  • Do you know any other anti-spam alternative, that does not disturb the users experience.

share|improve this question

migrated from stackoverflow.com Nov 28 '11 at 15:58

This question came from our site for professional and enthusiast programmers.

Good overview: nedbatchelder.com/text/stopbots.html – motoxer4533 Nov 28 '11 at 15:31
I am migrating this over to webmasters. Note that you might still need to improve the question to fit their standards. – NullUserException Nov 28 '11 at 15:57
I removed the request for CSS/HTML code as that is off topic here. You can ask that at StackOverflow. But I recommend writing your own code first and then asking them for help if you run into trouble. Just asking for others to write code for you will get lots of downvotes and maybe even have the question closed. – John Conde Nov 28 '11 at 16:09
What forum script are you using? Some already have honeypot implementations as plugins/modules/whatever. – Su' Nov 28 '11 at 18:17
@Rook CAPTCHAs have repeatedly been demonstrated as robot-solvable, and punish everybody regardless. This is about a human-transparent option. – Su' Nov 29 '11 at 4:01

What if CSS and javascript is turned off in a browser?

A proper honeypot won't rely on either of these to work. Ideally you will use a hidden form field for this which doesn't require any real hiding..

Do you see any other disadvantages in the honey pot trap?

If you do it properly there shouldn't be any issues that users will be aware of. There will be a tiny amount of overhead required for it to work but that should be so small it shouldn't even be a concern.

Do you know any other anti-spam alternative, that does not disturb the users experience.

From a previous answer: You could do several things (and should be doing more then one) including:

  1. Use a CAPATCHA like reCAPTCHA

  2. Use a field that requires the user to answer a question like what is 5 + 3. Any human can answer it but a bot won't know what to do since it is auto-populating fields based on field names. So that field will be either incorrect or missing in which case the submission will be rejected.

  3. Use a token and put it into a session and also add it to the form. If the token is not submitted with the form or doesn't match then it is automated and can be ignored.

  4. Look for repeated submissions from the same IP address. If your form shouldn't get too many requests but suddenly is it probably is being hit by a bot and you should consider temporarily blocking the IP address.

  5. Use Askimet. It is great at identifying spam.

Recommened reading: How do spambots work?

share|improve this answer
1 and 2 are intrusive. 3 can be automated as well. – NullUserException Nov 28 '11 at 18:16
@John Conde This was very helpful. I will try to improve my honey pot.thanks! – sfrj Nov 28 '11 at 20:19

I'm sure form bots will ignore any <input type="hidden"> fields. Best solution is to use text input as normal, with a common data type. Anything that you are not currently using is fine such as Website, Address, Zipcode, Username etc.

Add a message saying "if you can see this field please leave it blank". Wrap the message and input in a div element with CSS set to display:none.

Unfortunately while most spam bots are very simple and dumb, plenty are smarter and can detect any popular trick. Depending on the nature of the form it may be better to use CAPTCHA or Akismet.

share|improve this answer

Something that I don't often see suggested is a time-based captcha solution. Spam works best by getting it out there as quickly as possible. I replaced the Google hosted ReCaptcha with a 20-second submission delay for my contact forms using PHP sessions, and it cut down spam considerably. I came up with the delay time using Analytics data on user behavior.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.