9 ms·
My personal favourite quick-fix (which doesn't stand up to targeted attacks, but is a very effective band-aid), is to put the following : <input type='text' nam
by tomwalsham 14y ago
My personal favourite quick-fix (which doesn't stand up to targeted attacks, but is a very effective band-aid), is to put the following :
<input type='text' name='website' style='display:none'>
Then disallow any form submissions server-side which contain a value for 'website'. Automated bots can't resist filling out that field.
- shrub 14y agoThis happened to me recently with a WP blog. It happened quite by accident, however, since the client just didn't want the website field. When comments still came in with a URL, the client was concerned that I had screwed up - but it clicked right away for me that these must be bots. It might have been a little disheartening for the client, since a number of these spam messages were along the lines of "I have never read such a great article. I have bookmarked your blog and will come back every day to read more of your insightful posts." What unaware blog owner wouldn't want that on their comments? Crafty spammers.
- seanalltogether 14y agoMine is the reverse of this idea. I have an hidden field that when you click submit, I fill in with a token via javascript. If the correct token isn't present when submitting, i reject the comment.