Make sure that the script that is sending the POST is the same script of the form and that it is localized to the application.

Check the URL and the IP.

This can be spoofed to a certain degree, but it does work. Not foolproof, of course, but it does reduce all the garbage spam scripts out there to a manageable sum.

Here’s the link to the University of Washington study (it’s a PDF file)

http://webinsight.cs.washington.edu/papers/captchachi.pdf

Other research supports the result Sampa.com saw with their 10% boost in conversion rates. The University of Washington completed a study in December that found a little more than 10% of users were never able to complete several different types of CAPTCHAs presented to them (even after more than 3 tries). Among our clients who’ve dropped CAPTCHA in favor of Form Armor, we’ve consistently seen an increase of 9-12% in conversion rates, too.

Thanks for a great article!

On cancelbubble.com you have a strong motivation to prevent users from gaming the system – right now you have an email verification ‘blocker’ which prevents this casual activity (but not a dedicated attack). However, it will also negatively impact the number of completed registrations by some degree. You might want to consider new creative ways to allow people to ‘bubble up’ (digg) items without requiring them to activate first.

You can include some instructions on the registration confirmation page that indicates to the user to check their junk/spam folder for the email if they can’t find it in their inbox. This of course assumes users will read the message.