What is the best way to filter out Bots filling out forms on your site besides using Captcha?

Question

I've thought about using the hidden fields method, but I guess many bots are able to figure that out by simply looking for the hidden property. I just don't want to have another field or section that makes the form longer than it needs to be.

Answer 1

I've seen successful over-simplified "captchas" the do things like ask what is 1 + 2 rather than something hard to read.

A check box, as suggested above, is roughly comparable (and can go in either direction, "I'm a human" or "I'm not human"). For the latter, I'd recommend preventing it from rendering to humans by using a style of display:none as defined by a class in a <style> header, as that should be harder for a script to detect.

Another simple trick (with therefore limited mileage) would be to require javascript. Something like this should deter most spambots:

<form id="form1" action="how-to-enable-js.html">
  ...
</form>
<script type="text/javascript">
  document.getElementById("form1").action="real_action.cgi";
</script>

The "how-to-enable-js.html" file would live in the same directory (or else supply a path) and would have directions for how to enable JavaScript so the form can go to the right place ("real_action.cgi").

Any spambot that actually renders the page with a real engine would be able to bypass this test.

You could easily do all three.