I have a website and getting 1000s of emails from website form. All the forms are just with random content. I have added a javascript to all the fields to make sure all the fields are filled and they are just placing random contents in the fields.

In wordpress website automatic captcha is installed but as this is the html website I have added text captcha with letters which was sending spam leads again and was not able to block the spam emails. Than I tried adding image captcha but got response from clients that its very difficult for them. I am thinking of using numeric captcha like addition or subtraction questions.

Any other way of stopping spam or let me know steps for adding calculation captcha.

I just put in a random question on my website.

 

What is hotter? fire or ice.

 

Then you only submit the email if that field contains fire (make sure you transform the text so it's all lower case)

 

These spam bots bypass javascript very easily so that will not stop them. Javascript validation is only useful to reduce human error before the sever has to do any work, but you should always include server side validation - Then you can target bots or people with javascript turned off. So ensure that question is validated in your PHP file.

 

This method is working for me thus far. Not as secure as a Captcha but more user friendly.

You should use a honey trap with a captcha solution. Honey trap is a hidden input field and if a spam bot fills this that means the submitted data is not valid because the real user can't see this field.

 

ZigTrap is one of the WP honey trap solutions.

I was previously using a honey trap solution and it stopped some of the spam but a lot of it still got through. I think the bots are wise to that now - They could easilly look for input fields that have css properties of display:none or absolute / relative positioning along with obvious class names such as 'hidden'

 

I think asking a generic question has greater security than a honeypot. However it is slightly less user friendly. - i've not had any spam yet using this.

 

On the other hand the captcha is more secure than them both, but is the least user friendly. Horses for courses I say. Google uses Captcha so I'd follow their lead if security is of primary concern.

Edited April 20, 201313 yr by rbrtsmith

I thought using both of them is better than using one of them.

Edited April 20, 201313 yr by grimus

Yes you are right as you can save the server a bit of stress if your combating the majority of the spam using some javascript with the honeypot. or the random question.

 

For now I am doing it without the captcha as I want it to remain as user friendly as possible and I'm curious to see how well this method works.