Protecting web forms from spam without CAPTCHA
A hidden form plus a one-time cryptographic post stamp.
- Answers
- How do you protect a web form from spam without a CAPTCHA?
- Topics
- cloud · cyber-security · hacking · people · server · web · webdesign · work
- Full article on willem.com
- https://willem.com/en/2022-07-30_captcha-alternative/
Summary
Hide the form by avoiding the FORM tag, then require a one-time cryptographic token fetched just before submit. I have run this since 2016, and by 2022 it had handled millions of messages with fewer than 100 spam.
Full text
A typical form is trivial to automate: bots hammer the submit step, and hackers hunt for forms where they can manipulate the TO address to send spam through your server. CAPTCHAs block that but they are cumbersome, hurt conversion, punish people with poor sight, and the free Google version feeds data profiling. My forms use no FORM tag at all, just common elements like DIV, so scanners looking for forms never find them. Then the post stamp: just before submitting, the device asks the server for a one-time cryptographic token matching the message and the sender, which takes milliseconds and goes unnoticed. Submissions with an invalid token are silently ignored while the server always answers OK, making reverse engineering hard. Consider your threat model: this reduces spam while staying user friendly, it is not bomb proof.