GDPR-compliant spam protection can be implemented in the form of a honeypot. "Without JavaScript" (as stated in the title of this article) does not mean that we are presenting a server-side implementation here (<?php IF Honeypot field is filled THEN do not submit ?>), but rather that we take into account that bots also like to access forms without JavaScript and can therefore bypass a client-side implementation using JavaScript (<script>"IF Honeypot field is filled THEN do not submit"</script>).
So what does "honeypot" actually mean in this context? Essentially, we distract bots from the fields that are relevant for submitting the form by adding a hidden form field. If the bot fills it in, the form cannot be submitted.
An example could be:
<div class="field required" style="height:0; overflow:hidden;">
<label for="notiz" class="label"><span><?= $escaper->escapeHtml(__('Notiz')) ?></span></label>
<div class="control">
<input type="text"
name="notiz"
id="notiz">
</div>
</div>
with the following JavaScript check (context: Magento 2 online shop)
require(['jquery'], function($){
$('form').submit(function (evt) {
if($('#notiz').val()!=""){
evt.preventDefault();
}
});
However, the form should not be submitted even if the bot has JavaScript disabled. Disabling the submit button does not help, as it is not required to submit the form. A better approach here is to obscure the destination of the form by leaving the action attribute of the form element empty and populating it via JavaScript using a helper attribute, for example "data-action":
<script>
require(['jquery'], function($){
$(document ).ready(function (evt) {
$('#form-validate').attr("action", $('#form-validate').attr('data-action'));
$('#form-validate').removeAttr('data-action');
});
});
</script>
This method therefore provides GDPR-compliant protection against (bot) spam. This was seen in our web agency on a Magento 2 online shop.
