Ask HN: Contact form spam despite trying everything

2 points by pettycashstash2 349 days ago | 7 comments

I'm at my wit's end with contact form spam on my sites. I've tried:

CleanTalk - caught some spam but still getting through, plus the monthly cost adds up Turnstile - better UX than reCAPTCHA but bots seem to be solving it reCAPTCHA v2 - effective but users hate the image challenges reCAPTCHA v3 - invisible but I'm still getting 20-30 spam submissions daily even with strict thresholds

I've also implemented honeypots, rate limiting, basic keyword filtering, and email validation (both format checking and MX record verification). The spam is getting more sophisticated - proper English, realistic email addresses that actually exist, even passing behavioral checks. What I'm curious about: How does Hacker News handle spam so effectively? I rarely see spam comments here, and there's no visible CAPTCHA. Are you using something custom, or is there a service/approach I'm missing? For context, I get about 500 legitimate form submissions per month, so I need something that won't block real users while stopping the bot flood. What's worked best for your sites? Especially interested in hearing from anyone who's dealt with determined, human-like spam at scale.

sds357 348 days ago |

I eliminated virtually all spam submissions on my site by using hidden fields and checking for common browser automation flags. I didn't want to use intrusive captchas if I didn't have to.

pettycashstash2 348 days ago | |

I am aware of hidden fields and have implemented them. Can you elaborate on browser automation flags? Very much appreciated.

sds357 348 days ago | | |

https://developer.mozilla.org/en-US/docs/Web/API/Navigator/w...

If true, block

gus_massa 349 days ago |

> I rarely see spam comments here, and there's no visible CAPTCHA. Are you using something custom, or is there a service/approach I'm missing?

Go to your profile https://news.ycombinator.com/user?id=pettycashstash2 and enable "showdead". There is a lot of bad post that are [dead] and are hidden unless you really want to see them.

There is a mix of automated tools, but the details are part of the secret sause, dang never told them. Also a lot of manual moderation by the mods. And also, users can flag and downvote bad comments and with enough of them the post is marked as [dead].

A long time ago, I used Spambayes to filter email. I'm not sure if it van be adapted to filter your contact messages.

pettycashstash2 348 days ago | |

Thanks for the reply. Coca Cola recipe type of Secret sauce? I am now debating implementing sms code verification ( but this comes at cost).

gus_massa 348 days ago | | |

I remember a few pages that sed some stupid captcha like "please write the word orange" or "please calculate 204+109". It was a static value, so it was trivial to program. For not very popular blogs, it was good enough (a long time ago).

Also, other blog has a hidden field, that should be empty, but bots like filling all fields.

I'd try those stupid tricks, and if they fail I'd try to put Spambayes as a filter. It was nice because it has good/bad/unusual, and you may like to take a look at unusual stuff to detect false positives. (I'm not sure if there is a better alternative to Spambayes. I used it like 20 years ago.)