SPAM protection methods N° 3: timing everything again

#php

page navigation Daq bot 'ej real user Dung speed difference exploit laH. user normally few seconds page Daq stay (information absorb process, form fill je), bot fraction of second Daq Hoch Qu'. several ways exploit laH.

1. bot pagh human

average times lo' Dun. 404 error page max 3 seconds legh; long text (company news, About Us, imprint) law' poH read. page navigation multiple times 3 seconds Dung vaj Qagh! alternatively user page Daq time measure. navigation same time qaSDI' reH (3 seconds law' 'ach) document length Dach vaj Qagh. top-level developers page per average dwell time measure, X% law' deviate user bot consider. 'ach: user misclick page immediately leave pagh content expected pagh notice vaj average law' nom navigate - bot false consider. concept further think poQ :-)

2. PHP: variant numero uno

<?php
session_start();
if (time() - $_SESSION['last_navigation'] < 5) if (!isset($_SESSION['quicknavigation']) ? $_SESSION['quicknavigation'] = 1 : $_SESSION['quicknavigation']++);
if (time() - $_SESSION['last_navigation'] > 10) $_SESSION['quicknavigation'] = 0;
if (isset($_SESSION['quicknavigation']) && $_SESSION['quicknavigation'] == 8) die("Du bist höchstwahrscheinlich ein Bot!");
$_SESSION['last_navigation'] = time();
?>

nuq qaS? script Hoch page Daq call. current Unix timestamp 'ej last page load timestamp difference 5 seconds Dung vaj (user next page 5 seconds Dung navigate), session variable "quicknavigation" wa' increase (pagh 1 set undefined vaj). 5 seconds law' 10 seconds Dung vaj nothing - bot pagh human (bot something compute, found mail address save poH). 10+ seconds qaSDI' next navigation vaj "quicknavigation" value 0 reset (bot 10 seconds page analyze poQbe'). human conclude, value 0 reset (bots timeouts set laH - 'ach experience: bots information quickly pagh comment function quickly search, "quantity over quality"). 10 seconds qaSDI' complete data reset decide. user/bot 8x successive 5 seconds Dung navigate vaj bot message output (captcha ask?).

3. PHP: variant numero due

<?php
session_start();
if ($_SESSION['block'] === true) die('BOT');
if (count($_SESSION['navigation']) == 5) array_shift($_SESSION['navigation']);
if ($_SERVER['SCRIPT_FILENAME'] != $_SESSION['last_called_script']){
  $_SESSION['navigation'][] = time();
  $diff[] = $_SESSION['navigation'][1] - $_SESSION['navigation'][0];
  $diff[] = $_SESSION['navigation'][2] - $_SESSION['navigation'][1];
  $diff[] = $_SESSION['navigation'][3] - $_SESSION['navigation'][2];
  $diff[] = $_SESSION['navigation'][4] - $_SESSION['navigation'][3];
  $diff[] = $_SESSION['navigation'][5] - $_SESSION['navigation'][4];
  if (abs($diff[0] - $diff[1]) < 5 && abs($diff[1] - $diff[2]) < 5 && abs($diff[2] - $diff[3]) < 5 && abs($diff[3] - $diff[4]) < 5 && abs($diff[4] - $diff[5]) < 5) $_SESSION['block'] = true;
}
?>

Oh what the ... nuq qaS? last navigations average time measure. 5x 5 seconds Dung page change vaj session variable 'block' "true" set, user Hoch further pages vo' lock. captcha first start appropriate (user directly exclude pagh).

4. yaj

measures Daq potential bots detect laH 'ach false-positives never exclude laHbe'. user completely site vo' lock Qo' (navigation timing bot rap behave neH). navigation timing first suspicion express, captcha query measures take, site bots against effectively protect. ideas suggestions ghaj? comments Daq ghItlh (my review qaSDI' publish).