Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I remember a site closed due to misuse and i wonder if bots have a part of it. If the bot is POSTing something to my site what are ways i can combat it? I was thinking of setting some cookies and having the cookies changed via javascript + timestamp and sign (so yesterdays cookies cant be used today and next week).

I'm sure most people/bots would just use another site instead of enabling JS in their bot.

What else can i do? I'm thinking daily POST limit and a honeypot for generic bots who just randomly post spam

share|improve this question
add comment

3 Answers

You could do several things including:

1) Putting a fake field that only bots will see. Then if that field is submitted with the rest of the form you can ignore it (and ban them if desired). You can also trap bad bots who follow a hidden link.

2) Use a CAPATCHA like reCAPTCHA

3) Use a field that requires the user to answer a question like what is 5 + 3. Any human can answer it but a bot won't know what to do since it is auto-populating fields based on field names. So that field will be either incorrect or missing in which case the submission will be rejected.

4) Use a token and put it into a session and also add it to the form. If the token is not submitted with the form or doesn't match then it is automated and can be ignored.

5) Look for repeated submissions from the same IP address. If your form shouldn't get too many requests but suddenly is it probably is being hit by a bot and you should consider temporarily blocking the IP address.

6) Use Askimet. It is great at identifying spam.

share|improve this answer
5  
+1 - And, ideally, you'll implement a combination of the suggestions listed above in a user-friendly way (for example, if a user has Javascript disabled and therefore fails the Javascript-based authentication, present the user with a CAPTCHA) –  danlefree Oct 5 '10 at 18:51
add comment

John Conde outlines a lot of good approached. The problem with choosing an anti-bot/anti-spam technique is balancing effectiveness and convenience. It would be really inconvenient to have to fill out a CAPTCHA every time you want to post a comment or message, but if you only require a CAPTCHA on signup, then sometimes that doesn't deter spammers.

Some of the passive techniques are a good alternative, since they don't require any human action. The problem is that bots are getting more and more sophisticated, and if bots can solve CAPTCHAs, then they can certainly process JS and CSS. So you'll need to exercise a little ingenuity, such as using less-obvious CSS to hide your bot-trap fields.

But based on your question, I think you probably realize that the point isn't to create a bot-proof site, but just to create enough of a deterrent that bot users will simply choose other easier targets. So what is required here will vary from site to site, and will likely require some trial and error testing. I would try the least obtrusive techniques first.

Lastly, another way you can de-spam your site is to use peer moderation to remove any bot-submitted comments or manually submitted spam that slips through.

share|improve this answer
    
can you explain the idea of peer moderation? Does that involve normal users getting moderator rights or how do I have to imagine it? –  0xC0000022L Jun 25 '11 at 16:19
    
@STATUS_ACCESS_DENIED: sorry for the late reply, but peer moderation is basically something like digg, slashdot, stackexchange, etc. where users can moderate the content on the site by giving some form of positive or negative feedback. So you can automate the system such that, when enough users give negative feedback on a piece of content, it is automatically hidden or flagged for review. On sites like StackExchange, users can also flag comments/answers as spam, bringing it to the attention of the admins. This reduces the work that paid admins have to do. –  Lèse majesté Sep 23 '11 at 20:32
    
thanks. This, of course, would only work on high-traffic sites where enough users can be bothered to give feedback ;) –  0xC0000022L Sep 28 '11 at 8:03
add comment

As John Conde mentioned in his #1) and you mentioned, honeypot can work very well for most cases and most web sites. If it ever gets done in by a bot you can just do one of the other methods John mentioned as well. But honestly if your site is low or average traffic this should do the trick.

Example, one of my favorites:

<form action="/process-form">
<input name="email" placeholder="Enter Your Email">
<input name="email_address" placeholder="Enter Your Email" style="display:none;">
<input type="submit" value="Submit"></form>

Now when the form is submitted, an extremely high percentage of bots will fill out both "email" and "email_address" but humans will only fill out the one they see, "email" and not "email_address". So in your `/process-form' code you just have to check if email_address is (not) empty for verification.

Simple and effective.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.