It appears that some spam messages can get through reCaptcha so would there be another additional step to check if there is an actual human submitting forms? And would it make sense to have this additional check, considering that a human could be the one sending these messages?
1
-
Really. have you talked to your users? The captchas are bad enough now. You just have to live with the odd leak.– Rohit GuptaNov 9, 2022 at 19:04
Add a comment
|
1 Answer
You could additionally add a honeypot. This is a "trap" for bots. For example, a text field is hidden for real users, but it is visible for the bot and it fills it. If the field is filled in, the request is ignored. There are also plugins that can support you with this.
Another idea would be to generate an (in the backend) encrypted time stamp and send it with the request. You can then decrypt it and check how long the user or bot needed to fill the form. If it was too fast, way too slow or not a time stamp, the request is ignored. You may also want to ignore requests at the exact same time.
They are not 100% solutions, but ones that do not bother your users.
