What's the best Captcha?

[Tom Gilleland]

Okay, I'm starting to get too many spams in my contact form of my websites. So I want to implement a Captcha. Some of the graphic ones are stupidly hard to read, so I was looking for a logic based one. I guesss I could write one, but if there is one that is already done....

Which free Captcha do you guys think is the best one to use?

Tom

[James C. Smith]

I eliminated all spam on the Ricochet Lost Worlds forum with the simplest approach. You have to answer one question.

Ricochet _____ Worlds. Fill in the blank.

We had a lot of really bad spam and this amazing simple question has eliminated ALL of it. We still get new members signing up and I have not heard from anyone who has had trouble answering the question.

I think you just need a really simple question that is easy to answer in the context of your web site. People who know you or your products would have no trouble answering it. But people automatically spamming thousands of sites would have no clue what your site is all about.

[urbansquall]

"Are you a spam bot?" worked pretty well for mine. :)

[Nikster]

:D oddly enough I just signed up to a forum that used captcha and asked a simple question, was something like "what is 4+1"

[xDan]

Or have a field which must not be filled (hidden from users with display:none), the bots usually fill all fields.

[mot]

This works for me:

A simple question "2 x 3 = ?" and a field that is hidden and
automatically filled in by Javascript. This way 99% of people with Javascript
enabled won't be bothered by it at all, the rest will fill it in. The bots
attacking my websites so far haven't interpreted Javascript, so it works just
fine.

[Sillysoft]

On my blog I have a captcha that is "Type the word 'human' in this field: ____" and it basically stopped 100% of automated spams. Same idea as James'. Do something unique to your site and it can be very simple and still effective.

[Danimal]

Here's an easy to read one that I use. You need to get VeraSe.ttf from somewhere.

<?php
/*
Random validation (CAPTCHA) image

Use this script in your contact form, for you whois query tool or just there where some extra validation is needed. A session will be created inside a dynamic image file (requires GD library). The random value of this image appears inside the generated CAPTCHA image. The user has to enter this value into formfield. This value will be checked while processing the form. Without entering this value a form will not be processed.

example of usage:

inside your form
<input type="text" name="validator" id="validator" size="4" />
<img src="random.php" alt="CAPTCHA image" width="60" height="20" vspace="1" align="top" />

and test the value of the "validator" form field like:
if (!empty($_POST['validator']) && $_POST['validator'] == $_SESSION['rand_code']) {
process your form here
at least destroy the session
unset($_SESSION['rand_code']);
*/

// save this code in your random script
session_start();

//if (empty($_SESSION['rand_code'])) {
$str = "";
$length = 0;
for ($i = 0; $i < 4; $i++) {
// this numbers refer to numbers of the ascii table (small-caps)
$str .= chr(rand(97, 122));
}
$_SESSION['rand_code'] = $str;
//}

$imgX = 60;
$imgY = 20;
$image = imagecreatetruecolor(60, 20);

$backgr_col = imagecolorallocate($image, 238,239,239);
$border_col = imagecolorallocate($image, 208,208,208);
$text_col = imagecolorallocate($image, 46,60,31);

imagefilledrectangle($image, 0, 0, 60, 20, $backgr_col);
imagerectangle($image, 0, 0, 59, 19, $border_col);

$font = "VeraSe.ttf"; // it's a Bitstream font check www.gnome.org for more
$font_size = 10;
$angle = 0;
$box = imagettfbbox($font_size, $angle, $font, $_SESSION['rand_code']);
$x = (int)($imgX - $box[4]) / 2;
$y = (int)($imgY - $box[5]) / 2;
imagettftext($image, $font_size, $angle, $x, $y, $text_col, $font, $_SESSION['rand_code']);

header("Content-type: image/png");
imagepng($image);
imagedestroy ($image);
?>

[Tertsi]

It is incredible how most sites still use image captchas even though they are more likely to be less effective than custom, simple ones.

[James C. Smith]

Or have a field which must not be filled (hidden from users with display:none), the bots usually fill all fields.

I tried that one. It sounded great. I didn't help much at all. I think it may have hit the spam in half but that was still completely unmanageable. My simple context based question was much more effective. I think the context helps compared to something like "what is 4 +1"

automatically filled in by Javascript. This way 99% of people with Javascript enabled won't be bothered by it at all, the rest will fill it in. The bots attacking my websites so far haven't interpreted Javascript, so it works just
fine.

This is a great idea to have Java script skip it for most people. I wonder how long before the spam bots execute Java script.

[Tom Gilleland]

Thanks for all the solutions.

-Tom