0

I am blocking a huge number of bots, except the ones from search engines, and then only allowing 2seconds of session management.

However, spam bots are still able to by-pass these measure and create a huge number of requests which is 'killing' the server.

I have read other articles on this site but none seem to directly answer this issue.

Mario S
  • 11,715
  • 24
  • 39
  • 47
Raul Prakash
  • 1
  • 3

3 Answers3

0

A bot probably behaves faster than a human. You could time how long it takes them to fill out the form. Anything less than a second or two is a bot.

A bot probably doesn't have JavaScript turned on. You could use that to your advantage.

You could hide a link via css (or not give it any text) that takes the bot to a bot.cfm page, which could then set a session value.

There are some open source projects but I can't remember the names of them off the top of my head.

CF10 has a new validation function.

Phillip Senn
  • 46,771
  • 90
  • 257
  • 373
0

Ben Nadel has written some useful posts in his blog regarding spiders/bots.

http://www.bennadel.com/blog/1083-ColdFusion-Session-Management-And-Spiders-Bots.htm

http://www.bennadel.com/blog/154-ColdFusion-Session-Management-Revisited-User-vs-Spider-III.htm

For forms, I use <cfimage> to create a captcha image. I have found that stuffing the captcha phrase in a session variable can cause problems (I can't remember what the problems were though). So, I now use <cfencrypt> to include an encrypted phrase in the form itself. The action page decrypts the phrase and compares it to what the user put in the captcha form field.

Scott Jibben
  • 2,229
  • 1
  • 14
  • 22
0

I've found CFSPAMProtect to be very useful at blocking automated form fillers.

It bases its SPAM/HAM test on an aggregate score of a number metrics including time on page, mouse movement (via JS) as well as the classic hidden form fields that shouldn't be filled in (but are filled in by dumb robots).

You can assign your own weightings and monitor the SPAM catch via email to allow you to tailor things.

It can work on its own or link to some third party SPAM tools such as Akismet. So far I've found that it's good enough on it's own.

It's a custom tag and easy to implement in existing forms too which is nice.

Give it a go...

Matt Casey
  • 83
  • 5