为PHP邮件脚本添加简单条件拦截垃圾邮件机器人

Got it, let's tackle this spam issue without heavy refactoring or flaky captchas. Here are a few simple, low-effort tweaks you can add to your existing setup that should help block those persistent bots:

方案1：升级你的Honeypot（从可见到隐藏） #

Your current visible "leave blank" field works for some bots, but smarter ones can parse the text and skip it. A hidden honeypot is better because bots automatically fill every input field they find, while humans won't even see it.

修改表单代码： #

Replace your existing check field section with this hidden version:

<div class="form-group" style="display: none !important;">
  <label for="check">Leave this field blank (bots only)</label>
  <input id="check" type="text" name="check" class="form-control">
</div>

The display: none ensures humans won't interact with it, but bots will still try to fill it.

在mailscript.php里添加拦截逻辑： #

At the very top of your PHP script (before any email-sending code), add this check:

// Block submissions where the honeypot field is filled
if (!empty($_POST['check'])) {
    // Redirect to your thank-you page to keep the flow consistent (bots won't care)
    header("Location: ../thank-you-page.html");
    exit;
}

方案2：添加提交时间验证 #

Bots submit forms in milliseconds, but humans need at least a few seconds to fill out all fields. This check filters out any submissions that are too fast.

修改表单代码： #

Add this hidden input to your form (pick the version matching your form type):

<!-- If your form is generated with PHP -->
<input type="hidden" name="submit_time" value="<?php echo time(); ?>">

<!-- If your form is static HTML, use JavaScript instead -->
<input type="hidden" name="submit_time" id="submit_time">
<script>
document.addEventListener('DOMContentLoaded', function() {
    // Set timestamp when the page loads
    document.getElementById('submit_time').value = Date.now();
});
</script>

在mailscript.php里添加时间判断： #

// Check if submission is too fast (adjust 5 to your preferred minimum seconds, e.g. 3-10)
if (isset($_POST['submit_time'])) {
    // Handle PHP timestamp version
    if (is_numeric($_POST['submit_time']) && $_POST['submit_time'] < 10000000000) {
        $time_diff = time() - (int)$_POST['submit_time'];
        if ($time_diff < 5) {
            header("Location: ../thank-you-page.html");
            exit;
        }
    } 
    // Handle JavaScript milliseconds version
    else {
        $time_diff = (time() * 1000) - (int)$_POST['submit_time'];
        if ($time_diff < 5000) { // 5000ms = 5 seconds
            header("Location: ../thank-you-page.html");
            exit;
        }
    }
}

方案3：简单数学验证（友好且有效） #

A basic math question is way harder for bots to solve than captchas (unless they're specifically tuned to your form), and it's not annoying for humans.

修改表单代码： #

Add this section somewhere in your form (e.g., after the message field):

<div class="row">
    <div class="col-md-12">
        <div class="form-group">
            <label for="math_check">Please enter the result: 1 + 2 = ? <span class="warning-star">*</span></label>
            <input id="math_check" type="number" name="math_check" class="form-control" required="required" data-error="Please solve the math problem to confirm you're human.">
            <div class="help-block with-errors"></div>
        </div>
    </div>
</div>

在mailscript.php里添加验证逻辑： #

// Check math answer
if (isset($_POST['math_check']) && (int)$_POST['math_check'] !== 3) {
    header("Location: ../thank-you-page.html");
    exit;
}

Pro Tip: Combine these methods #

For best results, use 2 or all 3 of these checks together. Bots would have to bypass multiple layers to send spam, which is much less likely.

内容的提问来源于stack exchange，提问作者MisterSmith