A website owner adds a captcha to their contact form. For a week the spam stops. Then it comes back, about as much as before, and now real customers have to pick out traffic lights too.
It's a common story. The usual fixes each catch some spam bots, and each has a gap the bots have learned to walk through.
Captchas
A captcha asks the visitor to prove they're a person: tick a box, type some letters, pick the pictures with buses. Programs now solve most of them, and services sell solved captchas by the thousand for very little.
Real people find them slow and fiddly, especially on a phone or with poor eyesight. Some give up, and the form never gets sent.
IP blocklists
An IP blocklist turns away internet addresses known for spam. It works against bots that run from the same servers for months.
Many spam bots now borrow ordinary home internet connections, rented by the hour, so each visit can come from a different household. On one small website, about 92% of the addresses a group of bots used weren't on a well-known reputation list at the moment they visited. More on why IP blocklists miss most spam bots.
Message filters
A message filter reads what was typed and decides whether it looks like spam: links, odd words, copied text. It's good at obvious junk.
A bot can write a polite, normal-looking message, and many now do. A filter that only reads the words has nothing to catch. And to judge a message, most filters send it, with the sender's name and email, to an outside service.
Hidden fields and timers
Some forms add a hidden box that only a bot would fill in, or turn away anything sent too quickly. They cost nothing and catch the laziest bots. A bot that opens the page in a real browser sees the same form a person does, and simply waits.
Each fix looks at one thing. A bot only has to get that one thing right.
Looking at the whole visit
Think of an IP address as a phone number. A bot can get a new number every few minutes, so to an IP blocklist each call looks like a different customer. Blocking numbers one at a time never catches up.
Rabbitproof looks past the number at the phone. It looks at the whole visit, not just the address or the message, and asks whether it adds up as a real person. A bot can change its number in seconds. Changing the phone is much harder, and a phone caught on one website is known on every website Rabbitproof protects, whatever number it calls from next.
There's nothing for visitors to solve. On WordPress, nothing they type leaves your website. Every bot it turns away is listed with the reason, and a real person can be let back in with one click.
It isn't a filter for spam a person types in by hand. For that, keep a message filter alongside it.
Comparing products?
WordPress anti-spam plugins compared puts five side by side: what each one checks, what it costs, and what it sends away.
Filter spam bots without a captcha
Rabbitproof works in the background, with nothing for visitors to solve.
RabbitproofBot and spam protection for small websites.
