Protecting your web contact form from spam without PHP?

Question

I have to implement some kind of spam protection (captcha, etc.) for the existing web contact form. However, the original form uses the .cgi file on the virtual server, which I cannot access, so I cannot work with this script. PHP mail function is turned off .

I assume that I need my own cgi file, but I am not in perl and cgi :-)

Maybe you can point me to some solution to this problem.

Answer 1

You can do some kind of oblique antivirus if you assume that all your users have enabled javascript.

Install action forms on page 404 and in javascript change it to the correct action page. Example:

 <form action="nowhere_ahaha" id="myform"> ... </form> <script> document.getElementById('myform').action = '/form_action.cgi'; </script> 

All this works because bots usually don't run js, but human visitors do.

Answer 2

You can add Negative Captcha:

A negative captcha has the same purpose as your combination of images: "To prevent bots from submitting forms. Image (" positive ") captchas do this by implementing a step that only humans can take, but bots cannot: read mixed characters from an image But it’s bad. It creates usability problems, it has a conversion rate and it confuses a lot of people. Why not do it the other way around? Negative captchas create a form in which there are tasks that only bots can perform, but people cannot. It has the same effect, n In which (at least) the false positive identification rate is significantly lower compared to positive captchas, all of this happens without forcing people to go through any additional troubles to submit the form. This is really a win-win. [source] .

In your case, you are probably using Honeypot best: add a new field:

 <div style="position: absolute; left: -2000px;"><input type="text" name="surname" value="" /></div> 

This suggests that you are not interested in getting a last name. If people manage to fill out this field and send it, they will most likely be a bot: ordinary browsers will not show the field: ordinary users will not see it and, therefore, will not fill it.

Now, in your CGI script, just filter by "last name"; if installed, stop processing and give an error, or just leave it at the same time.

Or, if this is not possible, try filtering the results of the published forms to "where the entry does not have a set of last names." Say if you get the results in excel / CSV: just use excel to filter the elements with last name. Or use your email filters to move any email where the last name: .... matters to a special directory.