Can I prevent spam bots from submitting a form if its hidden?

Question

If I display:none over a form wrapper on my website contact page will a spam bot still be able to submit it?

If no, then would a possible solution be to just place a link saying - send us an email - and when clicked it display:show the wrapper with the form thus this preventing spam?

Thanks, -O

Answer 1

A spam bot is usually a script that is executed and run automatically. It's not an actual human being so the bot would not care if it is actually hidden by the style or not. You could add it to the DOM in the moment the user clicks a button if you wanted to prevent a "spam bot" to abuse it.

Answer 2

There are many different types of spam bot out there, and many different approaches used in filling in your form (and thus: sending you spam).

For the most part these are automated scripts which don't actually 'see' the page at all but simply use the markup it finds on-page. To that end, using CSS to hide a form won't stop them at all.

On the same vein: you'll find that there are a lot of bots out there which will scrape your email address and send you spam directly if you leave a mailto: link on your site.

There's no sure-fire way of stopping spambots I"m afraid. There are a lot of techniques that you could employ to reduce it though.

The most common is to use a captcha service like recaptcha although even this isn't a concrete guarantee that some spam still won't filter through.

The other trick I tend to employ is a Honey Pot input which is relatively easy to employ and seems to do a fairly good trick of keeping the spammers out.

Answer 3

Spambots are meant to be fast, and they don't parse CSS or JavaScript. If you want to protect against them you can include a CAPTCHA, even a simple one, like asking the user to write the sum or product of small numbers (obviously write the request in a sentence, using letters and not numbers). A cheap solution like this should prevent most spam, but it's easily attackable, if someone wants to target you.

I wouldn't suggest to create dynamically the form, since users that aren't capable to execute JavaScript wouldn't be able to see it.

Answer 4

If using a honey pot, which is the most user friendly, simple and extremely effective, try not to hide your input field with the css hidden command. Bots can see this if they are complex.. Position the field absolutely at the top of the form, to the left or right, have it with no border, and the background and text colour the same as the element the form is within.