We currently have a Contact Us form on our web page (name, email, comment field), but our issue is that we consistently receive spam from it.
The sender email changes each time and the text varies slightly.
If we had to use a captcha, are there metrics on whether a user would simply not send, using the form, because of it? (I'm open to other alternatives too.)
asked Sep 26, 2016 at 12:50
2 Answers
There are better methods for detecting bots without requiring the users to enter anything.
The honeypot technique
Bots usually try to fill every form field so they can submit and send the information successfully. However, if you put 1 form field which is hidden with CSS or JS humans won't be able to see it and fill it. Unlike humans bots will be able to see the visually hidden field and fill it. So if you detect messages that had filled the hidden form field - it is a bot.
Time based detection of bots
This technique relies on the fact that bots fill out form fields immediately where humans usually need some time. So if you see that the page loaded and after 0.3 seconds your forms were filled and send then - its most probably a bot.
Summary
People with screen readers will see the hidden form field so it should be named appropriately. In my opinion, it would be most efficient to mix both approaches so you can have better detection of spam bots without requiring extra user effort.
answered Sep 26, 2016 at 13:12
-
If I named the field appropriately, wouldn't a bot be able to detect that the form is intended for non-humans? Sep 26, 2016 at 13:29
-
1Usually bots are not that smart. Unless there is something like that out there that I'm unaware of?– Majo0odSep 26, 2016 at 13:35
-
1Maybe the bigger problem will be browser autofilling. If the browser autofills the hidden field you might be detected as bot. So the naming of this field is crucial. We should avoid names like first name, fname, ccard, etc. Sep 26, 2016 at 14:08
-
1Just implemented a simple honeypot and it's working like a charm. Oct 12, 2016 at 20:53
You should try Google's chapta "i am not a robot". It is very simple and not frustrating (aka has a good UX). For technical info you can read this Quora page
-
Yes, thought about that too. It's likely one of the least painful captchas out there. But I simply don't know the impact it would have on the response rate for a Contact Us form. Since it's a place for a potential customer to get in touch, we want to be careful about any friction we impose. Sep 27, 2016 at 18:33
.txtfile and occasionally review them. 100% spam and 0% legitimate users; the whole "well what if they have JS disabled" line is a hot load of steaming brownie pie. If someone has JS disabled then they should know enough to enable it if something is failing, the average users couldn't give two fits of a tish hit.