Spam Comment Bypass Honeypot: Implementing a Server‑Side Math Captcha
Patch: implement server‑side math captcha with session‑stored answer and single‑use token; replace honeypot and CSRF only checks.
Patch: add math captcha to comment form; generate random numbers, store answer in session, validate on submit; remove honeypot field.
Summary
The article describes a spam comment that bypassed the blog’s honeypot field, revealing that modern bots can detect hidden fields and skip them. The comment was posted by a bot that targeted a French technical blog with irrelevant content about Bangladeshi gaming. The honeypot technique failed because the bot did not fill the hidden input, and CSRF tokens did not prevent replay. Rate limiting was ineffective for a single submission. The author proposes a server‑side math captcha that stores the answer in the session, making it invisible to bots that only parse the DOM. The captcha generation uses random numbers and a single‑use token, while verification checks the session answer and token. The article includes PHP code for generating the captcha, rendering it in the form, and verifying the response. The author notes that external services like reCAPTCHA add tracking and GDPR concerns, so a simple math captcha is preferred. The solution improves spam protection without external dependencies.
Key changes
- Honeypot fails against modern bots
- CSRF token does not prevent bot replay
- Rate limiting ineffective for single submission
- Math captcha stored in session
- Single‑use token prevents replay
- PHP code provided for generation and verification
- Avoids external dependencies like reCAPTCHA
- Improves spam protection