将页面的某些部分转换为图像，这样机器人就无法理解它们。

例如，创建整数0-9、美元符号和小数点的小图像。当页面加载时将图像缓存到客户端计算机上…然后显示价格使用通过运行服务器端代码选择的图像。大多数人类用户不会注意到其中的差别，机器人也不知道任何商品的价格。

所以问题似乎是:机器人想要他们的“一袋垃圾”，因为它有很高的感知价值，以较低的感知价格。有时候你提供这个道具，机器人就会潜伏，等着看它是否可用，然后它们就会购买这个道具。

既然机器人所有者似乎正在盈利(或潜在盈利)，诀窍就是通过鼓励他们购买垃圾来让他们无利可图。

首先，总是提供“一袋垃圾”。

其次，确保那些废话通常都是废话。

第三，频繁地轮换垃圾。

简单的,不是吗?

你需要一个永久的“为什么我们的垃圾有时是垃圾?”链接，以向人类解释发生了什么。

当机器人看到有垃圾并且自动购买垃圾时，接收者会因为他们花了10美元买了一根坏牙签而非常沮丧。然后是一个空垃圾袋。然后是你鞋底的泥土。

If they buy enough of this crap in a relatively short period of time (and you have large disclaimers all over the place explaining why you're doing this), they're going to lose a fair "bag 'o cash" on your "bag 'o crap". Even human intervention on their part (checking to ensure that the crap isn't crap) can fail if you rotate the crap often enough. Heck, maybe the bots will notice and not buy anything that's been in the rotation for too short a time, but that means the humans will buy the non-crap.

见鬼，你的老客户可能会很开心，因为你可以把这变成一个巨大的营销胜利。开始发布“垃圾”鲤鱼卖了多少。人们会回来看看机器人被咬得有多厉害。

更新:我预计你可能会接到一些投诉电话。我不认为你能完全停止。然而，如果这杀死了机器人，你总是可以停止它，并在以后重新启动它。

为什么不将内容设置为CAPTCHA?

On the page where you display the prize, always have an image file in the same location with the same name, when a bag o crap sale is on, dynamically generate and load an image with the text etc advertising the prize, when no sale is on just have some default image that integrates well with the site. Seems like its the same concept as CAPTCHA... if the bot cannot figure out the meaning of the image they will not be able to "win" it, if they can they would have been able to figure out your CAPTCHA images anyways.

您可以尝试让脚本更难阅读价格。最简单的方法是将其转换为图像，但文本识别算法仍然可以解决这个问题。如果有足够多的脚本编写人员能够解决这个问题，您可以尝试对该图像应用类似验证码的东西，但显然是以牺牲用户体验为代价的。而不是图像，价格可以在一个flash应用程序。

或者，您可以尝试设计一种方法，以某种不影响呈现的方式在页面中“洗牌”HTML。我一时想不出一个好的例子，但我确信它在某种程度上是可行的。

我将要描述的方法有两个要求。1) Javascript被强制执行2)一个具有有效http://msdn.microsoft.com/en-us/library/bb894287.aspx浏览器会话的web浏览器。

如果没有其中任何一个，你就是“故意”倒霉的。互联网被设计成允许匿名客户查看内容。简单的HTML没有办法解决这个问题。哦，我只是想说，简单的，基于图像的验证码很容易被击败，甚至作者也承认这一点。

Moving along to the problem and the solution. The problem is in two parts. The first is that you cannot block out an individual for "doing bad things". To fix this you setup a method that takes in the browsers valid session and generate a md5sum + salt + hash (of your own private device) and send it back to the browser. The browser then is REQUIRED to return that hashed key back during every post / get. If you do not ever get a valid browser session, then you reply back with "Please use a valid web browser blah blah blah". All popular browsers have valid browser session id's.

现在我们至少有了该浏览器会话的标识(我知道它不会永久锁定，但是通过简单的脚本很难“更新”一个浏览器会话)，我们可以有效地锁定一个会话(例如;让脚本编写人员很难访问你的网站，而不会对有效用户造成任何惩罚)。

Now this next part is why it requires javascript. On the client you build a simple hash for each character that comes from the keyboard versus the value of the text in the textarea. That valid key comes over to the server as a simple hash and has to be validated. While this method could easily be reverse engineered, it does make it one extra hoop that individuals have to go through before they can submit data. Mind you this only prevents auto posting of data, not DOS with constant visits to the web site. If you even have access to ajax there is a way to send a salt and hash key across the wire and use javascript with it to build the onkeypress characters "valid token" that gets sent across the wire. Yes like I said it could easily be reversed engineered, but you see where I am going with this hopefully.

现在为了防止不断的交通滥用。有几种方法可以在给定有效的会话id后建立模式。这些模式(即使使用Random来抵消请求时间)的epsilon比人类试图重现相同的误差范围时要低。由于您有一个会话ID，并且您有一个“看起来像一个bot”的模式，那么您可以用一个简单的轻量级响应屏蔽该会话，该响应是20字节而不是200000字节。

You see here, the goal is to 1) make the anonymous non-anonymous (even if it's only per session) and 2) develop a method to identify bots vs. normal people by establishing patterns in the way they use your system. You can't say that the latter is impossible, because I have done it before. While, my implementations were for tracking video game bots I would seem to think that those algorithms for identifying a bot vs. a user can be generalized to the form of web site visits. If you reduce the traffic that the bots consume you reduce the load on your system. Mind you this still does not prevent DOS attacks, but it does reduce the amount of strain a bot produces on the system.

防止DoS会挫败@davebug上面所概述的第二个目标，“保持网站的速度不被机器人减慢”，但不一定能解决第一个目标，“把项目卖给非脚本编制的人”。

我敢肯定，脚本编写人员可以编写一些东西来在过度的限制下滑行，这仍然比人类完成排序表单的速度要快。