Honeypot Submit

Component ID

2333631

Component name

Honeypot Submit

Component type

module

Maintenance status

Development status

Component security advisory coverage

not-covered

Component created

Component changed

Component body

This is a simple module that is very useful at stopping form spam bots from submitting Drupal â„¢ forms like user registration. It replicates the submit button on a form and hides the original. When a bot comes along, they execute submit() or click on the first/primary submit button of the form. These submissions are blocked because they are assumed to be a bot or some automated process. When an actual visitor comes to the site they won't see the original button and are required to click the replicated one.

Note: currently they have to click the button, so the form is not submitted when the enter key is pressed on a textfield form element.

Installation instructions:
Download and install the module
Create a hook in your theme or custom module to define the forms you want to protect (see below)
Clear caches
Inspect source of forms to verify there are multiple submit buttons


/**
 * Implements hook_honeypot_submit_form_ids_alter().
 */
function MYMODULE_honeypot_submit_form_ids_alter(&$form_ids) {
  // Protect all user forms.
  $form_ids[] = 'user_login';
  $form_ids[] = 'user_pass';
  $form_ids[] = 'user_register_form';

  // Protect a webform.
  $form_ids[] = 'webform_client_form_283';
}

Notes
I developed this for clients because they wanted a solution that didn't use captchas or a third party content filtering service. It's been highly effective and has basically eliminated user registration spam for my clients. I'm not sure how long this technique will be effective because a bot can easily be reprogrammed to work around it. Please test it out and provide feedback in the issue queue.