A really pain aspect of managing a website is the constant influx of bots which are dedicated to spam. Even a website with low traffic can be the target of a bot, since this website is linked by another one. The result is that the comments are wasted by spam and the read of an article with its responses become awful. Moreover, the situation is getting worst because of the increase of the number of bots and the ease of use of the programs behind these bots.

Many solutions are used to fight against bots, but each one has its own advantages/disavantages and efficiency. We can make two categories : solutions that try to avoid the bot for posting (captcha audio, video and text for example), and solutions that analyze the text submitted in a form in order to find out that it wasn't written by a human (bayesian filter for example).

The solution I am currently thinking about and I have tried to implement is part of the first category. It tries to detect the presence of a bot by using AJAX and Javascript technologies. Let's try to explain how it should work : by default, when a new connection is made, it is categorized as a bot until a human event is detected. This kind of event can be a move of the mouse or a press of a key. This is detected by the JavaScript event onMouseMove and onKeyPress. If such an event is made, we categorized the connection as being performed by a human. Then, we can allow it to post a comment, to keep surfing on our website or whatever we want.

The first implementation tells us who is human or not. Bots appear in red. It works by adding a new entry in a database when a new connection is made. And when a human event occurs, it updates this entry by telling that it's not a bot. I have made another implementation in which a form appears when the user moves the mouse or presses a key. I will try to adapt this script to Dotclear in order to make an antispam.

After two days of work on this website, the first script seems to work quite good, but I wonder how it could handle a high traffic website. Finally, to be critical, we can made two objections against this solution. The first one, which actually fits many other solutions, is that it works until a bot counter attacks. How can it do that ? By simulating the move of the mouse or the press of a key. In this case, maybe we which should analyze the speed of the mouse to detect how human it is... The other objection is that if JavaScript is not activated on the client browser, then our solution is useless. But fortunately, many browsers allow JavaScript by default.

The concurrence of such a solution with text analysis could be an even better solution as it doesn't affect accessibility (the main reproach of captchas), and if Javascript is not activated on the browser, there is another filter (on the text).

I will provide the full source code soon.