你不能完全阻止机器人，即使有验证码。但是，您可以让编写和维护机器人变得痛苦，从而减少机器人的数量。特别是强迫他们每天更新他们的机器人，你会让大多数人失去兴趣。

下面是一些让机器人更难编写的想法:

Require running a javascript function. Javascript makes it much more of a pain to write a bot. Maybe require a captcha if they aren't running javascript to still allow actual non-javascript users (minimal). Time the keystrokes when typing into the form (again via javascript). If it's not human-like then reject it. It's a pain to mimic human typing in a bot. Write your code to update your field ID's daily with a new random value. This will force them to update their bot daily which is a pain. Write your code to re-order your fields on a daily basis (obviously in some way that's not random to your users). If they're relying on the field order, this will trip them up and again force daily maintenance to their bot code. You could go even further and use Flash content. Flash is totally a pain to write a bot against.

一般来说，如果你开始采取一种不阻止他们的心态，而是让他们更加努力，你可能会实现你正在寻找的目标。

问:你如何阻止脚本写手在一秒钟内上百次地攻击你的网站? A:你不需要。外部代理无法阻止这种行为。

你可以使用大量的技术来分析传入的请求，并尝试启发式地确定谁是人，谁不是人……但它会失败。最终，即使不是马上。

唯一可行的长期解决方案是改变游戏，使网站不再对机器人友好，或者减少对编剧的吸引力。

你是怎么做到的?那是另一个问题了!: -)

...

好吧，上面已经给出了一些选项(并拒绝了)。我对你的网站不是很熟悉，只看过一次，但由于人们可以阅读图像中的文本，而机器人无法轻松做到这一点，所以将公告更改为图像。不是验证码，只是一个图像-

generate the image (cached of course) when the page is requested keep the image source name the same, so that doesn't give the game away most of the time the image will have ordinary text in it, and be aligned to appear to be part of the inline HTML page when the game is 'on', the image changes to the announcement text the announcement text reveals a url and/or code that must be manually entered to acquire the prize. CAPTCHA the code if you like, but that's probably not necessary. for additional security, the code can be a one-time token generated specifically for the request/IP/agent, so that repeated requests generate different codes. Or you can pre-generate a bunch of random codes (a one-time pad) if on-demand generation is too taxing.

运行真实的人对这个问题的响应的时间试验，并忽略('哎呀，发生错误，对不起!请再试一次’)的反应比一半的时间要快。此事件还应该触发警报，提醒开发者至少有一个机器人已经弄清楚了代码/游戏，所以是时候修改代码/游戏了。

继续定期地改变游戏，即使没有机器人触发它，这只是在浪费编剧的时间。最终，编剧会厌倦这款游戏，去别的地方……我们希望;-)

最后一个建议:当你的主页收到请求时，把它放到一个队列中，然后在一个单独的进程中按顺序响应请求(你可能不得不入侵/扩展web服务器来做到这一点，但这可能是值得的)。如果来自同一IP/代理的另一个请求进入，而第一个请求在队列中，忽略它。这将自动减轻机器人的负载。

编辑:另一种选择，除了使用图像，是使用javascript来填写购买/不购买的文本;机器人很少解释javascript，所以他们不会看到它

只是一个旁注:在我看来，问题是，你的用户期望的行为非常类似于一个机器人(大波来，未经认证，点击每个按钮:))，所以验证码可能是唯一能够识别它的图灵测试:))。

这样怎么样:创建一个表单，如果有新商品正在出售，就会收到一封电子邮件，并添加一个捕捉系统，将相同的内容发送给任何在X秒内刷新的人。

这样你就赢得了所有的场景:你摆脱了刮刮器(他们可以刮掉他们的电子邮件帐户)，你给了那些不会在你的网站上买东西的人机会!如果我真的想买东西，我肯定会在我的手机里收到电子邮件并登录购买。

已经发布了一些其他/更好的解决方案，但为了完整起见，我想我会提到这个:

If your main concern is performance degradation, and you're looking at true hammering, then you're actually dealing with a DoS attack, and you should probably try to handle it accordingly. One common approach is to simply drop packets from an IP in the firewall after a number of connections per second/minute/etc. For example, the standard Linux firewall, iptables, has a standard operation matching function 'hashlimit', which could be used to correlate connection requests per time unit to an IP-address.

虽然，这个问题可能更适合于上一个so播客中提到的下一个so衍生产品，它还没有推出，所以我想可以回答:)

编辑: 正如novatrust指出的那样，仍然有ISP实际上没有分配ip给他们的客户，因此有效地，这样一个ISP的脚本客户将禁用该ISP的所有客户。

我喜欢BradC的回答(使用Ned Batchelder文章中的建议)，但我想在此基础上再增加一个层次。您不仅可以随机化字段名称，还可以随机化字段位置和使它们不可见的代码。

Now, this last bit is hard part and I don't know exactly how to do it, but someone with more JavaScript and CSS experience might be able to figure it out. Of course, you can't just keep the same positions all the time, because the scripters will just figure out that the element with position (x,y) is the real one. You would have to have some code that changes the positioning of form elements relative to other elements in order to move them off the page, overlay them on each other, etc. Then obfuscate the code that does this with some randomness introduced into it. Automatically change the obfuscation daily, before a new item is made available. The idea is that without a proper CSS and JavaScript implementation (and code to read layout of the page as a human would) a bot won't be able to figure out which elements are being shown to the user. Your server-side code, of course, knows which fields are real and which are fake.

总而言之:

字段名是随机的 字段顺序是随机的 字段隐藏代码很复杂 字段隐藏代码是随机混淆的 服务器端代码每天自动更改随机因子

在你给出的限制条件下，我不认为有办法避免某种形式的“军备竞赛”，但这并不意味着一切都完了。如果你能在军备竞赛中实现自动化，而编剧不能，那么你每次都能获胜。