I have compiled a list of items that may protect a web form from span. Which are actually effective? Please feel free to add additional items.
- Store a code as a hidden field and verify it when submitted.
- Use jQuery to set the method and action fields after page loads.
- (Also) Use jQuery to encode the action URL
- Encode the entire webform and use jQuery to decode it after the page loads.
- Use AJAX instead of the standard submit button action.
- Use CAPTCHA
- Place CSS-hidden fields of the form that only bots will find and fill in.
- Recording time between page load and submission, ignore if less that 1 second.
- Load the form into the page via AJAX, one second after page loads.