I remember a site closed due to misuse and I wonder if bots have a part of it. If the bot is POSTing something to my site what are ways I can combat it? I was thinking of setting some cookies and having the cookies changed via JavaScript + timestamp and sign (so yesterday's cookies can't be used today and next week).

I'm sure most people/bots would just use another site instead of enabling JavaScript in their bot.

What else can I do? I'm thinking daily POST limit and a honeypot for generic bots who just randomly post spam.

4 Answers 4


You could do several things including:

  1. Putting a fake field that only bots will see. Then if that field is submitted with the rest of the form you can ignore it (and ban them if desired). You can also trap bad bots who follow a hidden link.

  2. Use a CAPTCHA like reCAPTCHA

  3. Use a field that requires the user to answer a question like what is 5 + 3. Any human can answer it but a bot won't know what to do since it is auto-populating fields based on field names. So that field will be either incorrect or missing in which case the submission will be rejected.

  4. Use a token and put it into a session and also add it to the form. If the token is not submitted with the form or doesn't match then it is automated and can be ignored.

  5. Look for repeated submissions from the same IP address. If your form shouldn't get too many requests but suddenly is it probably is being hit by a bot and you should consider temporarily blocking the IP address.

  6. Use Askimet. It is great at identifying spam.

  • 5
    +1 - And, ideally, you'll implement a combination of the suggestions listed above in a user-friendly way (for example, if a user has Javascript disabled and therefore fails the Javascript-based authentication, present the user with a CAPTCHA)
    – danlefree
    Commented Oct 5, 2010 at 18:51

John Conde outlines a lot of good approached. The problem with choosing an anti-bot/anti-spam technique is balancing effectiveness and convenience. It would be really inconvenient to have to fill out a CAPTCHA every time you want to post a comment or message, but if you only require a CAPTCHA on signup, then sometimes that doesn't deter spammers.

Some of the passive techniques are a good alternative, since they don't require any human action. The problem is that bots are getting more and more sophisticated, and if bots can solve CAPTCHAs, then they can certainly process JS and CSS. So you'll need to exercise a little ingenuity, such as using less-obvious CSS to hide your bot-trap fields.

But based on your question, I think you probably realize that the point isn't to create a bot-proof site, but just to create enough of a deterrent that bot users will simply choose other easier targets. So what is required here will vary from site to site, and will likely require some trial and error testing. I would try the least obtrusive techniques first.

Lastly, another way you can de-spam your site is to use peer moderation to remove any bot-submitted comments or manually submitted spam that slips through.

  • can you explain the idea of peer moderation? Does that involve normal users getting moderator rights or how do I have to imagine it? Commented Jun 25, 2011 at 16:19
  • @STATUS_ACCESS_DENIED: sorry for the late reply, but peer moderation is basically something like digg, slashdot, stackexchange, etc. where users can moderate the content on the site by giving some form of positive or negative feedback. So you can automate the system such that, when enough users give negative feedback on a piece of content, it is automatically hidden or flagged for review. On sites like StackExchange, users can also flag comments/answers as spam, bringing it to the attention of the admins. This reduces the work that paid admins have to do. Commented Sep 23, 2011 at 20:32
  • thanks. This, of course, would only work on high-traffic sites where enough users can be bothered to give feedback ;) Commented Sep 28, 2011 at 8:03

As John Conde mentioned in his #1) and you mentioned, honeypot can work very well for most cases and most web sites. If it ever gets done in by a bot you can just do one of the other methods John mentioned as well. But honestly if your site is low or average traffic this should do the trick.

Example, one of my favorites:

<form action="/process-form">
<input name="email" placeholder="Enter Your Email">
<input name="email_address" placeholder="Enter Your Email" style="display:none;">
<input type="submit" value="Submit"></form>

Now when the form is submitted, an extremely high percentage of bots will fill out both "email" and "email_address" but humans will only fill out the one they see, "email" and not "email_address". So in your `/process-form' code you just have to check if email_address is (not) empty for verification.

Simple and effective.


I used to have a Word Press sports website, and I had the site-builder add a comments section (using another program) to it.

I found out the hard way that there is only ONE guaranteed way to keep bot and human-generated spam and ads out of the comments section:

Eliminate the comments section.

In other words, have an email address, which, of course, will attract a lot of spam and ads itself, and let readers who want to comment email you their comments. Then, you pick out the real comments, and type them in yourself, on additional website pages.

Or, if you really want to make it hard on programs that send spam, you could require people to use the U.S. Mail(!) and have to get an envelope and a stamp to mail you their comments.

It's a lot of work, but the alternative is...there is no alternative that I know of. :)

  • What about Akismet?
    – Steve
    Commented Nov 1, 2020 at 21:05
  • in my experience using captcha and a hidden honeypot field eliminates 99.9% of the spam while putting my email address on the web page guarantees that it gets way to much spam to handle. Commented Nov 2, 2020 at 10:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.