If you are a website owner and are inundated with various kinds of spam from form-submitting robots, don’t sweat it. There are ways to catch these spambots in the act, and prevent them from working efficiently.
I’m sure you are already familiar with some of the more annoying methods for reducing spam, such as random images, trick questions, and CAPTCHA security codes. I’m not about to suggest any of those solutions. Instead, I’ll offer a simple solution that is very easy to implement and completely unobtrusive.
The concept is simple – Give the bots what they are looking for.
Spam-generating robots (spambots) are programs that automatically scour the web, seeking-out any website forms, checking them for vulnerabilities, populating form fields with garbage, and submitting the forms. The spambots remember where the vulnerable forms are located, and return later to do it again.
I spend a large amount of time analyzing spambots and devising methods for preventing spam attacks. Some methods, I have to admit, are not as user-friendly as I would prefer. So, this time I’m posting something that’s painless to use.
The instructions are simple. Copy the following form and paste it directly before any other content in your website (after the <body> tag).
<div style="position: absolute; top: -1000px; left: -1000px;"><form action="about:blank" method="post"> <input type="text" name="name" /><input type="text" name="email" /><input type="text" name="website" /><input type="text" name="url" /><input type="text" name="link" /><input type="text" name="subject" /><input type="text" name="message" /><input type="text" name="comment" id="comment" /><input type="text" name="username" /><input type="text" name="password" /><input type="text" name="user" /><input type="text" name="pass" /><input type="submit" value="submit" name="submit" /><input type="submit" value="submit comment" name="submit" /><input type="hidden" value="botform" name="botform" /> </form> </div>
If you have PHP enabled on your server, use the following code instead. Otherwise, skip to the next section.
The PHP example will send you an email containing the results of the form submission, and/or automatically ban the spambot by writing the spambot’s IP address to htaccess.
Be sure to edit the Config section to suit your needs.
<?php
/**
* @author JasonLau.biz
* @license GNU/GPL 3.0+
* @copyright 2012
* @name BotForm
* @version 1.0.2
*/
/* BEGIN BOTFORM */
/* BEGIN BOTFORM CONFIGURATION */
define(BOTFORM_UNIQUE_NAME, "my_spambot_form");
// A unique name for this form.
define(EMAIL_ALERT, true);
// Dispatch an email alert upon submission? true or false
define(EMAIL_FROM, "do-not-reply@" . eregi_replace("www.","",$_SERVER['SERVER_NAME']));
// Email address this message is sent from.
define(EMAIL_TO, "");
// Email address this message is sent to.
define(EMAIL_SUBJECT, "Spambot alert!");
// Email subject line.
define(ADD_IP_TO_HTACCESS, true);
// Automatically ban the spambot? true or false
define(PATH_TO_HTACCESS, "");
// Server path to .htaccess relative to this script, if writing to .htaccess. No trailing slash.
define(PATH_TO_HTACCESS_BACKUP, "");
// Server path to where you want to save a backup copy of .htaccess, relative to this script, if writing to .htaccess. No trailing slash.
define(HTACCESS_BACKUP_NAME, "");
// A unique name for the .htaccess backup file
define(TARGET_FIELD_NAMES, "name, user, username, userid, first, last, email, comment, link, website, url, subject, message, pass, password");
define(USE_COOKIES, true);
// Use cookies to help thwart repeats
define(UNIQUE_COOKIE_NAME, "ban");
// A unique name for the cookie
/* END BOTFORM CONFIGURATION */
/* Be sure this next portion of script is placed before any output or errors may occur. */
/* Check if cookies are enabled */
if(USE_COOKIES):
/* Check if the cookie exists */
if(isset($_COOKIE[BOTFORM_UNIQUE_NAME])):
/* Send the user about:blank page */
header("Location: about:blank");
exit;
endif;
endif;
/* Check if botform was submitted */
if($_POST[BOTFORM_UNIQUE_NAME] == BOTFORM_UNIQUE_NAME):
/* Check if cookies are enabled */
if(USE_COOKIES):
/* Set the cookie */
@setcookie(UNIQUE_COOKIE_NAME, 1, time()+60*60*24*365);
endif;
/* Check if email alerts are enabled */
if(EMAIL_ALERT):
/* Assemble email message */
$message = "The spambot form was submitted from ".$_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"]."\n\nIP: " . $_SERVER['REMOTE_ADDR'] . "\n\n" . "User Agent: " . $_SERVER['HTTP_USER_AGENT'] . "\n\n";
/* Check if add to .htaccess is enabled */
if(!ADD_IP_TO_HTACCESS):
$message .= "Add the following line to .htaccess:\ndeny from " . $_SERVER['REMOTE_ADDR'] . "\n\n";
else:
$message .= "The following IP address was added to .htaccess:\n" . $_SERVER['REMOTE_ADDR'] . "\n\n";
endif;
$message .= "Content of submission:\n\n";
/* Loop through the Post'd fields and add to message */
foreach($_POST as $k => $v):
$message .= $k . " => " . $v . "\n";
endforeach;
/* Send the alert */
@mail(EMAIL_TO, EMAIL_SUBJECT, $message,"From: " . EMAIL_FROM . "\n" ."X-Mailer: PHP/" . phpversion());
endif;
/* Check if add to .htaccess is enabled */
if(ADD_IP_TO_HTACCESS):
/* Backup the existing .htaccess file */
@copy(PATH_TO_HTACCESS . "/.htaccess", PATH_TO_HTACCESS_BACKUP . "/" . HTACCESS_BACKUP_NAME);
$fp = @fopen(PATH_TO_HTACCESS . "/.htaccess", "a+");
@fwrite($fp, "\n# Spambot " . date("M d, Y") . " " . date("g:i A") . "\ndeny from " . $_SERVER['REMOTE_ADDR']);
@fclose($fp);
endif;
die();
endif;
/* Output the form */
$target_fields = explode(",", TARGET_FIELD_NAMES);
$target_form = "<div class=\"" . BOTFORM_UNIQUE_NAME . "-container\" style=\"position: absolute; top: -1000px; left: -1000px;\">\n<form action=\"#\" method=\"post\">\n";
foreach($target_fields as $field):
$target_form .= "<input type=\"text\" name=\"" . trim($field) . "\" />\n";
endforeach;
$target_form .= "<input type=\"text\" name=\"" . BOTFORM_UNIQUE_NAME . "\" value=\"" . BOTFORM_UNIQUE_NAME . "\" />\n</form>\n</div>\n";
print $target_form;
/* END BOTFORM */
?>
How does this reduce spam?
This reduces spam by giving the spambots exactly what they are looking for; a form to submit. Other than that, the form does nothing at all. Simply put, the spambot reaches a dead-end once the form is submitted. Your human website visitors will experience no hassles from this method of spam control. Because of the CSS settings of the form container, your website visitors will not even see the form. However, spambots will find the form immediately by scanning the webpage’s source code. Being the first form on the webpage, it will be the form that gets submitted. Additionally, the form itself contains numerous fields whose names are commonly targeted by spambots, so it will naturally attract the attention of spambots, drawing them away from more important things.
I hope you have found this article helpful, and that you are able to eliminate spam using this method.