getgrav / grav-plugin-form

Grav Form Plugin
http://getgrav.org
MIT License
53 stars 79 forks source link

Some improvements about honeypot solution #598

Open maofree opened 2 hours ago

maofree commented 2 hours ago

Hi

I would like to make the honeypot solution work well, unfortunately even if it is present in the form, it does not filter the spam messages that arrive every day. Yes with google recaptcha I solve this problem, but in my opinion it is not working well. In the wordpress cf7 plugin I use a plugin "Honeypot for Contact Form 7" and this solution on wp does not receive spam, even if I do not use the recaptcha. One thing I notice is that in cf7 the honeypot field does not appear, while in the Grav form it

<input aria-hidden="true" type="text" style="visibility:hidden;position:absolute!important;height:1px;width:1px;overflow:hidden;clip:rect(1px,1px,1px,1px);" class="form-honeybear" name="data[honeypot]" value="">

how do spam see that this field is for protection? could it be the presence of honeypot in the "data" field?

why in cf7 if I activate it it doesn't appear and it filters spam messages well?

my doubt is, if honeypot works on cf7, why not make it work on Grav too which is much better?

could you study how the plugin "Honeypot for Contact Form 7" works to adopt the same solution? https://it.wordpress.org/plugins/contact-form-7-honeypot/


Honeypot shouldn't include honeypot in field name or use inline visibility styles. Easy for bots to identify. so from the input field you should remove all things that can be used to understand that it is a honeypot field

I hope this can help to improve this option

thanks

maofree commented 2 hours ago

the css style code is already present in the form-honeybear class, so the inline style can be removed from the input field

5

maofree commented 2 hours ago

so you just have to replace name="data[honeypot]" with e.g. name="data[applejuice]"

and probably also class="form-honeybear" with class="form-applejuice"

to remove honey