Item — HN Reader

In my experience, bots don't execute JavaScript (yet).

I add a hidden "spam" field to the form. When the form is submitted, I use Javascript to remove it. If the field is still present when sending to the server, flag the entry as spam. This has blocked all spam bots for us.

2 comments

definitely this - I've done this a ton on Drupal/Wordpress also the "confirm I am not a spammer" checkbox does seem to cut down on submissions considerably.

IMO, a losing battle no matter what. A certain amount of spam is always going to get through. The real challenge is to do this without compromising your UX.

In addition to javascript cookies help as well. Many don't handle cookies.