Avoiding spam messages from information fields on website

Airwolf1

Unsure if anyone will understand the title, but hopefully this will make it easier to follow!

We have a website. On the website there is a "request information" section, where someone can enter their details and it generates an email to us. This wasn't working, but we got someone to fix it. Now it works, we're getting spam messages, which I assume are bots. We now filter out anything containing "http" or hyperlinks which has slowed down the spam, but we're now getting some more. A lot of it is nearly the same, but we're wondering how to stop this (bearing in mind we want to receive genuine queries).

We thought of a captcha device - but would this work? Can bots actually get round these now, are they that sophisticated?

The other option was to implement a delay of some sort, so that there would be a delay between the page loading and the submit button being enabled. Would this work?

Or can any of you offer any other good solutions?

Many thanks.

inamabilis

The other option was to implement a delay of some sort, so that there would be a delay between the page loading and the submit button being enabled. Would this work?

No because the bots aren't actually 'clicking' the button, just searching the HTML for the address the form is being submitted to and in effect, submitting manually.
Captcha is your best bet - http://recaptcha.net/whyrecaptcha.html

Airwolf1

Thank you, any more suggestions folks?

Wombat

I use a "honey trap" on my forms and find it very effective. The explanation of this can be seen here:

http://www.davidnaylor.co.uk/stopping-bad-robots-with-honeytraps.html

This is also an interesting article on different methods:

http://www.sitepoint.com/article/captcha-problems-alternatives/

With a follow-up discussion:

http://www.sitepoint.com/forums/showthread.php?t=551192

where people outline the good and bad points of each method.

DatabaseError

a captcha is your best bet, your hosting package may involve IP filtering options, including a block list of known spammers.

Dime_Bar

Captcha is definatly the best but loads of people hate it, I usually set it so it just looks like whitenoise with the writing on rather than with all the lines. You do not want to put real people off.

isofa

I've been having the same problem, mine aren't bots, definitely manual submissions, only a handful every week, the script record the IPs, and it's all secure, impossible to get hold of the e-mail address or read the script.

A good Captcha is the solution, if you have time to implement it!

Airwolf1

So, regarding captchas. Are bots sophisticated enough these days to actually do these too or not?

Thank you