Anti-spam question and google recaptcha added for html contact form but still getting spam messages, how to completely stop?

Question

We implemented the below anti-spam question code into our html contact form. Also google recaptcha is active on the form. But still getting spam of dating and automated other spam messages.

Here is the anti-spam question code:

<td align=center><font class="err"><TMPL_VAR msg></font><label for="turingtest"> <strong>Anti-Spam Question:</strong> Which is the wrong name of this website?: example, link or example.com? *</label>
<br>
<input type="text" required="required" pattern="[ ]*(link)[ ]*" title="Pick the fluffiest animal"/>
<br><input name="send" type="submit" name="btn" value="<TMPL_VAR lang_send_message>"></td>

So this does not work. Maybe some automated spammers are using different techniques. What else we can do?

And how to implement much more powerful anti-spam question and approach into html contact form?

Here is the contact form part code:

<Table width="90%">     
    <tr>
        <td><TMPL_VAR lang_name>:<br /><input type="text" name="name" value="<TMPL_VAR name>" maxlength=32></td>
    </tr>
    <tr>
        <td><TMPL_VAR lang_email>:<br /><input type="text" name="email" value="<TMPL_VAR email>" size=24 maxlength=32></td>
    </tr>
    <tr>
        <td class="editor"><textarea id="message" name="message" rows=7><TMPL_VAR message></textarea></td>
    </tr>   

    <TMPL_IF ihtml>
    <tr>
        <td align=center><TMPL_VAR ihtml></td>
    </tr>
    </TMPL_IF>
    <tr>

Note: Using a server with CentOS and Apache. Plus perl script and their html pages.

Answer 1

It is impossible to completely stop spam submissions to your contact form. You can always get spam that is manually submitted. It is very possible to create a contact form that gets very little spam. I created a free open source contact form. I use it on all my sites and get just a handful of spam each month.

The main techniques for preventing spam with a contact form are:

• Check all data server side. Don't rely on client side JavaScript to stop spam. If all your checks are executed client side in the browser, they are trivial for spammers to circumvent. You can use client side for usability. Users encounter errors more quickly. However, you can't use only client side verification.
• Disallow HTML and bulletin board code for links. I allow bare URLs to be submitted, but block submissions with <a or [url . Many spammers are actually trying to submit comments with links to your site. This stops that.
• Include hidden fields like <input type=hidden name=your-name and check to make sure it doesn't get filled in. Many bots try to put text in it even though users can't.
• Use Google's recaptcha. The new "check the box" recaptcha is unobtrusive to most users and does a decent job of catching spammers. It will work better than your unsophisticated captcha.
• Require a valid referrer from your site. Spammers often try to submit without a referrer header, but almost all users with real browsers have that.
• Change the name of the fields. Instead of <textarea name=message use <textarea name=ce88o. Users never see what the name is, but obtuse names make it harder for spammers to figure out what data goes in what field.