Contact Form Honeypots

If you have a contact form on your website, you will end up receiving a lot of spam unless you take steps to prevent it. Most of this spam comes from “spam ‘bots”—or automated programs that prowl the web looking for contact forms and submitting spam through them.

The problem with some protection methods is that they make like extremely difficult for honest people, which is a real downer. The worst option, in my view, is the CAPTCHA field—those horrid things that present you with contorted lettering that you can never decipher. In my view, making life harder for your legitimate site visitors is a bad move.

Honeypots

A nicer option is known as a “honeypot”—a less obtrusive option that trips up the bots while not troubling your visitors. Some honeypots present all users with a question, such as “what is 2 + 2”. If the answer “4” is not submitted, then the form is not sent. This is an easy enough question for a human, but a bot may have no idea what to put there (as they often just fill inputs with spammy nonsense).

Still, asking a silly question like that is an imposition on your users. So another option is to use this option but to hide the input with CSS (say, by positioning the input off screen or by using display: none;). The bot will see the input and fill it in, but most users won’t see the input. Rather than ask a question, you could set it up so that if anything is submitted into that field, the form aborts. The only thing to watch for here is that people using screen readers (or those with CSS off) may see this input, so you need to warn them by saying—“Leave this blank!” or similar. Still, it’s a bit of a clunky process.

Using a Honeypot Timer

A much nicer and less obtrusive kind of honeypot is a timer. This is a hidden field that records the time the page was loaded and then compares that time with the time the form was submitted.

A bot will normally submit a form within a few seconds, while a legitimate user will need to spend a lot more time reading the labels and typing answers. So the timer field can be set up to abort the form if it is submitted within a few seconds. That way, bots are caught out, but legitimate users are none the wiser—never troubled by silly questions or those hateful CAPTCHA fields.

A Code Example

I first saw this timer method suggested in the SitePoint Forums by felgall. I’m no PHP expert, but I wanted to figure out how to do this, and here’s what I came up with. Firstly, here’s the hidden code I include in the form itself:

<input type="hidden" name="loadtime" value="<?php echo time(); ?>">

Then, in the PHP that processes the form, I have this:

$loadtime = $_POST["loadtime"];

$totaltime = time() - $loadtime;

if($totaltime < 7) {
    echo("Please fill in the form before submitting!");
    exit;
}

So, if the page has been open for fewer than 7 seconds when the form is submitted, it aborts. It’s unlikely that this will catch out legitimate users, but it should give the bots a run for their money.

You can see an example of this in action here.

Regular Honeypot

In some scenarios, you might not be able to use the timer method—such as when your form processing script is in a file external to the page on which the form appears. In that case, you can use a regular honeypot.

Here, I will place a field in the form that requires a specific answer:

<div class="hide">
    <label for="spam">What is two plus two?</label>
    <input name="spam" type="text" size="4" id="spam">
</div>

I’ve wrapped the input/label pair in a div for styling purposes, and asked a pretty simple question. Firstly, via CSS I’ll hide that pair:

.hide {display: none;}

I prefer to use display: none than to position the content off screen, as assistive devices are less likely to see it if set not to display (so I believe). I’d prefer that people using screen readers etc. not be troubled by this field, but in case they do see it, the label explains what to do.

In the PHP that processes the form, I set the form to abort to abort if it contains any content that is other than “4” or “four”:

$spa = $_POST["spam"];

if (!empty($spa) && !($spa == "4" || strtolower($spa) == "four")) {
    echo "You failed the bot test!";
    exit ();
}

So there are two options for tripping up bots that won’t leave your site visitors frustrated and hating you.

if (!empty($spa) && !($spa == "4" || strtolower($spa) == "four")) {
echo "You failed the bot test!";
exit ();
}

echo '<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Error</title>
<link href="css/style.css" rel="stylesheet" type="text/css" media="all">