Stop SPAM from custom form

I’ve been studying (and blocking) automated form spam for years. Most advice relates to hidden fields, CSS tricks, ‘stupid’ questions (“what is 1+3”), and others.

And the reason that those tricks (and others) don’t work with automated spam bots is that they don’t ‘see’ your form, they just post to it. They scrape the form, grab the form fields, and use automated techniques (like CURL) to post to the form. (I wrote a post about how they do it here:

So, you have to hide things. I’ve developed a process (free) that obfusticates the submit form, using JS delays (among others), and can implement reCAPTCHA (which is a good start, but not complete). The result is a ‘contact’ form (which can be modified to add other fields) that has not been successfully attacked by spam-bots. (In fact, I challenge anyone to spam-bot the form on that site, and none have after years of using the technique – which I have improved over the years.)

All of the code is free, and available at my FormSpammerTrap site. I send it to anyone that wants it, and don’t use (or keep) the emails of those that request it. I think it is quite successful at blocking automated spam. All the details are on the site.

I welcome automated attacks. Always have. Never get any.