CAPATCHA vericode not bot secure

I have a form that still gets spammed by bots even tho I use CAPACHA.

Maybe we could have better versions for this or have other way’s to protect the form from spambots

I will try to change the images and the color of the font to see if the bots can be stoped maybe the contast of the images and the text is to big.

DImmy

Look at Bob Ray SPF (Spam Protected Form); I bet you’ll stop ’em cold.

I didn’t have that problem but until now I never coded a big page. I am relatively new to webprogramming but I come from OOP (Delphi) and as a matter of fact: every spamprogram can decide between every color which is in a picture and filter it so that the whole dummy code in the back has no sense anymore. If it already knows modx pages: "ah, this is a modx page! So I’ll check this drunken blue for information". Maybe the safer way would really be to put the dummycode in the background and the real captcha code in one color or simply every char in another color. If the captcha is as big as it is now, furthermore, people will be able to read it easily but not spam bots.

greetings
Max

I used several broken fonts from dafont that are used random and i changed the contrast now it is human readable but I think that machines have a hard time to read it
we will see if this does the trick.


DImmy

The trouble with those solutions is that they make the image difficult to read for humans as well and the difficulty varies a lot from image to image. One solution is to modify the image selection process to leave out easily confused letters like r/v l/1, 0/o, etc.

A better solution, IMHO, is to present an image of a randomly generated math problem and have the user enter the solution (e.g. 3 + 2). SPForm does this and you’re welcome to take the code that generates the mathstring and saves the solution in a SESSION variable. Even if the BOTs are good enough to decode the image, they aren’t smart enough to solve it.

Three other options worth considering:

1. Using a non-hidden but invisible input field that bots will mistakenly fill in.
2. Using a javascript timer and rejecting submissions that take too much or too little time.
3. Javascript code that requires the use of the mouse and/or keyboard in submitting the form.
4. Limiting the number of http links allowed in a message.

SPForm has all of these as options so you can see how it’s done in the code.

One nice thing about SPForm is the there are dozens of possible combinations of spam-proofing options so each site will present a unique challeng to the bots.

Bob