Nancy's Web If you don't know where you've been, how do you know where you are?

Gotcha is sort of a take off on "captcha." The idea was first mentioned on http://drupal.org/node/166921< as a possible way to trick spam bots who try to use the Drupal contact form. I don't particulary like the extra step humans are required to perform in these "verification" methods, and some just don't work.

The idea is simple: Basically you place a bogus input field on a contact form, and use CSS to not display it. On submission you check for a value. If there is a value entered, then that means a non-human has been blanketing form fields, and the form post can be ignored as spam. The spam bot will probably never know.

Gotcha adds a field labeled "Subject" at the top of the contact form. It uses a "div" tag to render the field as "display: none" so human users shouldn't see it, and won't enter any data there. Hopefully, the suspected spam bot will see "Subject" and be enticed to enter something there. There is descriptive text to encourage a human (whose browser might be set to display it anyway) to ignore this field.

Gotcha intercepts the contact form submission and checks the hidden field. If something is there, Gotcha simply returns to the front page and ignores the message. The attempt is logged, along with the submitter's IP address, and the suspect message is saved in the database. If the field is empty, then the message is passed on through to the contact module for normal processing.

Unfortunately, most of the spam was still getting through. And most of that was a bunch of links to drugs or porn. From exerience, I knew that the Spam< module was already good at dealing with this in comments. After browsing that module, I found that I could "hook" into its filters and use them to identify spam.

All of my spam emails stopped immediately!

See the change log<

Required Modules

The Gotcha module requires the core Contact module and the contributed Spam< module (which you can also use to limit comment spamming).

Installation

Normal module installation procedures.

Settings

All of the settings for Gotcha are found in the Administer » Site building » Contact form, under the "Settings" tab.

• Log all email - If this box is checked, all site-wide Contact email will be logged in the Gotcha table. If it is not checked, only suspect emails will be logged.
• "Go Away" page: - This is the path to the page to be displayed when the message has been identified as spam. That message should be tactful, but forceful. When the module is enabled, it checks to see if there is a page that is titled "Gotcha: Go Away!". If is present, that node's id will be set here. If is not found, the module will create a sample page and set the new page's path here. Note: It is not necessary for this pageto be in "published" status as it will be displayed anyway.
• Maximum body - The maximum size of the message's body to show in the logging list. This limits the size of the displayed list.
• Rows per Page - The number of rows to show per page in the logging list.
• Show Site Name - If selected, the site's name will show in the logging list. This is useful in a multisite environment with a shared "gotcha" log.

Menu Items

Administer » Logs » Gotcha list - shows all the emails that have been logged. It has a delete link to allow you to clean up the table.

CSS<

The module does implement a basic style sheet. I recommend that you not change the "gotcha_covered" style. If you use CSS compression, you may have to disable and re-enable it for this module.

The Future

It is my intention to work with the author of the Spam module to integrate this functionality into that code. If, or when, that happens, I will de-commission this module shortly after that.

To Do List

• Build an IP address blacklist? Share with spam module?
• Expire email log after some interval?
• Do the same type of thing with comments?
• Check IP address against current list (and Spam's list)?

This module can be found at http://drupal.org/project/gotcha<.