{"action":"opened","issue":{"url":"https://api.github.com/repos/cferdinandi/tarpit/issues/4","labels_url":"https://api.github.com/repos/cferdinandi/tarpit/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/cferdinandi/tarpit/issues/4/comments","events_url":"https://api.github.com/repos/cferdinandi/tarpit/issues/4/events","html_url":"https://github.com/cferdinandi/tarpit/issues/4","id":53520375,"number":4,"title":"Check for no-JS","user":{"login":"msigley","id":4201801,"avatar_url":"https://avatars.githubusercontent.com/u/4201801?v=3","gravatar_id":"","url":"https://api.github.com/users/msigley","html_url":"https://github.com/msigley","followers_url":"https://api.github.com/users/msigley/followers","following_url":"https://api.github.com/users/msigley/following{/other_user}","gists_url":"https://api.github.com/users/msigley/gists{/gist_id}","starred_url":"https://api.github.com/users/msigley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msigley/subscriptions","organizations_url":"https://api.github.com/users/msigley/orgs","repos_url":"https://api.github.com/users/msigley/repos","events_url":"https://api.github.com/users/msigley/events{/privacy}","received_events_url":"https://api.github.com/users/msigley/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-01-06T14:36:45Z","updated_at":"2015-01-06T14:36:45Z","closed_at":null,"body":"In my experience one of the first things a spam bot will try to do to bypass spam protect is render the comment form with javascript turned off and try to submit the form.\r\n\r\nI handle this is my comment forms by enforcing javascript written times:\r\n```js\r\nwindow.onload = function() {\r\n\t\t\t\t         \t\tvar form_created_microtime = document.getElementById(\"form_created_microtime\");\r\n\t\t\t\t\t\t\t\tform_created_microtime.value = new Date().getTime();\r\n\t\t\t\t\t\t\t};\r\n\t\t\t\t\t\t\tvar commentform = document.getElementById(\"commentform\");\r\n\t\t\t\t\t\t\tcommentform.onsubmit = function(e) {\r\n\t\t\t\t\t\t\t\tvar form_submitted_microtime = document.getElementById(\"form_submitted_microtime\");\r\n\t\t\t\t\t\t\t\tform_submitted_microtime.value = new Date().getTime();\r\n\t\t\t\t\t\t\t};\r\n```\r\n\r\nI then check the time differences in my comment_validate function to determine if the comment is spam.\r\n```php\r\n//Check post velocity (time between post form creation and form is being processed). A post velocity of less than one second is definitely a spam bot.\r\n\t\tif(!empty($_POST['form_created_microtime']) && !empty($_POST['form_submitted_microtime'])) {\r\n\t\t\tif( ($_POST['form_submitted_microtime'] - $_POST['form_created_microtime']) < 1000 )\r\n\t\t\t\treturn true;\r\n\t\t} else {\r\n\t\t\treturn true;\r\n\t\t}\r\n\t\t//If we made it here, the comment isn't spam.\r\n\t\treturn false;\r\n```"}}