If I were to generate my field names randomly each time a contact form was rendered, would that help prevent SPAM bots from recognizing the fields? Can they read label text?

1 Answer 1


It will help but it won't prevent it from stopping all spam. The changing name fields, assuming they are unique every time the form is displayed, will help stop the bots that depend on knowing the form fields ahead of time to complete the form. It will also help stop the bots that look for exact field names like "name" and "email", etc.

What it won't stop are bots that are smart enough to look for field names that are like common field names but not always exactly the same. They look for fields that contain common field names like "name" and "email". So if your form uses those identifiers inside of your dynamic field names they will still get through. Your idea also won't stop human spammers at all. They'll just fill out the form and submit it without any difficulty at all.

If you want to stop bots, these are some options you can implement along with your dynamic field names:

1) Putting a fake field that only bots will see. Then if that field is submitted with the rest of the form you can ignore it (and ban them if desired). You can also trap bad bots who follow a hidden link.

2) Use a CAPATCHA like reCAPTCHA

3) Use a field that requires the user to answer a question like what is 5 + 3. Any human can answer it but a bot won't know what to do since it is auto-populating fields based on field names. So that field will be either incorrect or missing in which case the submission will be rejected.

4) Use a token and put it into a session and also add it to the form. If the token is not submitted with the form or doesn't match then it is automated and can be ignored.

5) Look for repeated submissions from the same IP address. If your form shouldn't get too many requests but suddenly is it probably is being hit by a bot and you should consider temporarily blocking the IP address.

6) Use Askimet. It is great at identifying spam.

  • Thanks John. What if the field names are completely random alphanumeric strings? (Such as 8f532GH1.)
    – Belmonster
    Commented Aug 25, 2011 at 13:32
  • That will stop the bots that look for common field names for sure.
    – John Conde
    Commented Aug 25, 2011 at 13:33
  • Also, can the amount of time it takes between the form page being shown and the action page being accessed be a potential check? (If I'm correct, wouldn't a bot be able to submit instantaneously, where a human would take longer?)
    – Belmonster
    Commented Aug 25, 2011 at 13:35
  • That is good in theory but it's hard to say how quickly someone can fill out a form. If you keep the timeframe short, say no more then three seconds, then I would think you wouldn't affect a human who was submitting a form. Anything that can potentially stop a human from filling out the form is always something that really needs to be thought out as you never want to turn away real users no matter how bad spam gets.
    – John Conde
    Commented Aug 25, 2011 at 13:38
  • Thanks again! I also found your response to: webmasters.stackexchange.com/questions/3588/… to be really helpful in understanding how they work.
    – Belmonster
    Commented Aug 25, 2011 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.