Ways to Block Automatic Form Spam

There are two types of form spam.

One is the type of spam that occurs when a robot automatically fills in form fields and submits the form. It is the type of form spam this article addresses.

A second type of form spam is when a human pastes unwanted drivel into a form and submits it. Such spam can be reduced, but the techniques are outside the scope of this article.

Here, you will find practical information for blocking automated form spam by robots. There is no specific code. Instead, the article is designed to impart a general understanding of how the methods work.

The "prove you are human" method, sometimes called CAPTCHA, is not addressed here other than to say I do not like CAPTCHA at all and won't use forms that require it unless I absolutely have to.

The methods here can be used with forms that are inviting rather than deterring.

In other words, the form can be ready to use — as is.

Nothing extra needs to be done. The person fills in the form and submits — and is good to go.

Yet, bots get blocked.

Form Pulled in With JavaScript

Probably the easiest method is to pull the form in with a script tag.

The form is in a separate file. It has either been pre-converted to JavaScript or is converted on demand when it is imported.

The method described at Import Text as JavaScript can be used to retrieve the form from your file and insert it into the web page.

When the form is not on the web page, the bot is unaware of it.

Please note, however, that some bots will pull in script content to look for forms.

Diversion

More effective bot-blocking is the diversion.

With the diversion, the form tag's action attribute has a value of an incorrect URL. After the form is loaded into the browser, only then does JavaScript update the action attribute with the correct URL.

Because some bots may wait a second or so to see if the action attribute changes, the attribute may be updated after a pause. Either of these should work:

• Update the action value when a couple seconds have passed since the page has loaded.

• Update the action value when a required form field is clicked or tapped.

It may be prudent to do code-obfuscation on the correct URL so the bot doesn't pick it up with a quick scan.

Relatively Simple Form Spam Prevention presents nuances of the diversion idea.

Form Delivered With Ajax

Ajax can be used to pull in a form and flow it into a div coded for it.

When no form is on the page, the bot sees no form.

One way to do this is described at the Ajax Form System article.

Because some bots may pause for a second or so to see if the page changes, the Ajax may be coded to pull in the form after a few seconds have elapsed.

Non-Form Form

The "form" content can be "submitted" (sent to the server for processing) with Ajax when the user taps a div that is styled to look like a submit button.

That is, basically, how Spam-Free Form works. There is no form tag. There are no HTML form text fields. In fact, there are no type="input" fields at all. (The Willmaster contact form is a working example of a spam-free form.)

A form-seeking bot won't recognize a spam-free form as a form, because it is not an HTML form.

There are bot-handling form techniques other than those mentioned in this article. The methods here may, however, be the easiest types of techniques to implement.

(This article first appeared with an issue of the Possibilities newsletter.)

Will Bontrager