Possible Duplicate:
How can I prevent spam on sites which I control?

ReCaptcha is all the rage at the moment,

Based on customer/user feedback, what other captcha or general human verification tools have you used for your website?

Links to the API/Site appriciated,

Thanks guys!


8 Answers 8


I like to use Honeypots in my forms since the user won't notice them, they keep most crap away but are not 100% foolproof. The trick is to make a new form field in your existing form, for example <input type="text" name="email" id="mailfield"/> and put #mailfield { display: none; } in your CSS. If your form is submitted with data in the email field you can be pretty sure it's a bot and discard the message.

  • I love this method, it is so simple to implement and really effective. Jul 12, 2010 at 19:59
  • Wouldn't all the decent bots have adapted to this method by now?
    – Casebash
    Jul 13, 2010 at 23:13
  • @Casebash It's possible that some bots could outsmart this method but they would definitely be considered the exception and not the norm. It's generally safe to say that the majority of bots crawling for spam are stupid. Jul 15, 2010 at 0:56

Use a combination of timestamp, spinner, field names, and honeypots...

Read this article for the detailed example.

A timestamp is exactly what it sounds like. A hidden field that marks the time when the form was originally opened. This defeats playback bots that copy a form and replay back the submission process over and over with different data each time. If the timestamp isn't close enough in relation to when the form is submitted the submission is automatically rejected.

A spinner is a hash using data from the timestamp, IP address, entry ID of the article, and a secret.

Field names are all generated by applying the hash to the 'real' field names. By comparing the field names with the spinner during the post-processing stage you can verify whether the person/or bot is the same as the one who originally opened the form.

The Honeypot has already been explained by @D4V360. It's essentially a hidden field that acts as an invisible trap for bots. If it's filled in with data then the form is automatically rejected.

  • I don't usually like to rely heavily on an article for an answer but this one is too in-depth to briefly summarize. It's definitely a good read. Jul 12, 2010 at 17:30

I like low-tech: Doing a simple math problem works well.

Enter what 4 + 4 adds up to:

Then check server-side for 8.

This is one I've used successfully on blogs using the Math Comment Spam Protection Plugin.

Adding an extra field to your forms like:

<input name="bots_only" value="" style="display: none" />

Usually, if bots_only is passed along with a value then you've got a bot. Though browsers without CSS will see that field, if you place it after your submit button it should get ignored even if it is for some reason visible.

  • +1 Yeah, low-tech captchas also are quite useful. Dec 22, 2010 at 16:13

I've also used simple natural language challenges, such as :

A ________ is something with numbered pages surrounded by two covers.
Hint: Rhymes with look

The caveats of this approach is having to maintain a separate challenge/hint/answer file for each language that you want to support, but I'm leaning in this direction more and more as CAPTCHA images become increasingly harder to read for some people. My wife, for instance wears heavily corrective lenses and gets extremely frustrated when she fails the 'human check' several times, even when the site is using RE-CAPTCHA.

Challenges in plain text also have the benefit of changing as users set accessibility controls to their liking.

The only requirement for the visitor is an elementary degree of literacy, so this might not work on sites like YouTube or Yahoo Answers.

  • 2
    On the contrary, it may make the comments less cringe worthy
    – Casebash
    Jul 13, 2010 at 23:12

Captcha2 is another alternative. It works by clicking three letters following instructions on screen. Not sure how this stands up to internationalisation. It's also not free after the first 1000 impressions. If you're after something a little more light hearted then KittenAuth is interesting - click 3 kittens to continue. Finally, to see how captchas are standing up to automated cracking take a look at the PWNtcha site. It has an open source solution for cracking captchas along with details on the toughest types.


One thing that it's worth noting is that more and more spammers are using real people to do their work, rather than bots. In which case, worrying about which captcha or honeypot to use isn't going to be very useful.


I have only administered one forum, which is phpBB-based. Recaptcha was a godsend, instating it for user registration and unregistered posts reduced spam to a fraction. Additionally we still use a blacklist filter which does keep out some remaining spam but may be more annoying than helpful.


I use Ads Captcha. It's neat, simple and effactive, but more than that: it uses Ads as the captchas. So everytime someone comments, i make money. it's a great benefit, since i'd use some captcha anyway. in spam prevention manners: it reduced my spam to 0.

Not the answer you're looking for? Browse other questions tagged or ask your own question.