Idevs

I would like to clarify some points on using “the honeypot” method of Spam filtering.

The basic method goes, you place a decoy input field within your form and hide it from the users, but not from the spam bots. The spam bots come along and fill in all the fields and submit the form. You can then filter the input during the server side processing of your form.

This all works very well but in order to make it that little bit more useful and user friendly I want to clarify some points:

1. Use CSS to hide the input and label, do not use the hidden method, any spam bot programmer with half a brain can get round that.
2. If you do use CSS then please inform users that don’t use CSS e.g. those using screen readers /text browsers. That they should not enter anything in the field e.g. Make your label something like “Leave this blank” or “Don’t write anything here”. Don’t compromise usability and try not to confuse your users.
3. Javascript processing is very well, but remember a raw request is all that is needed to post the data to your processing script so when using Javascript don’t bother checking for spam.
4. Combine techniques. Once you get rid of all the bots that fall for the honeypot consider checking for known spam keywords, if you need some ideas check your email. There are loads of different techniques you can use and combine.
5. Moderate! don’t rely solely on your code, read your comments once in a while, answer them. This will make you a better blogger and help build a sense of community, and you can pick up on the spam that may have escaped the net and of course learn how to stop it getting through again.

I would be interesting to learn of anymore ideas that you have regarding this issue.

This entry was posted on Saturday, August 4th, 2007 at 12:00 am and is filed under . You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.