不是技术解决方案，而是理论解决方案。

1.给出一个单词或一个声音。“将鼠标移动到屏幕左上角，点击橙色按钮”或“点击这里，然后点击这里”(需要多步响应) 当任务完成了，问题就解决了。选择已经在页面上的对象，让它们单击。至少完成两个动作。

希望这能有所帮助。

最近，我开始添加一个标签，名称和id设置为“message”。我将它设置为隐藏与CSS(显示:none)。垃圾邮件机器人看到它，填写并提交表单。服务器端，如果文本区域与id名称填写我标记为垃圾邮件。

我正在研究的另一项技术是随机生成名称和id，其中一些是垃圾邮件检查，另一些是常规字段。

这对我来说非常有效，我还没有收到任何成功的垃圾邮件。然而，我的网站的访问者却少得多:)

如果你做一个有不同颜色字母的验证码，并且你要求用户只输入特定颜色的字母呢?

Make an AJAX query for a cryptographic nonce to the server. The server sends back a JSON response containing the nonce, and also sets a cookie containing the nonce value. Calculate the SHA1 hash of the nonce in JavaScript, copy the value into a hidden field. When the user POSTs the form, they now send the cookie back with the nonce value. Calculate the SHA1 hash of the nonce from the cookie, compare to the value in the hidden field, and verify that you generated that nonce in the last 15 minutes (memcached is good for this). If all those checks pass, post the comment.

This technique requires that the spammer sits down and figures out what's going on, and once they do, they still have to fire off multiple requests and maintain cookie state to get a comment through. Plus they only ever see the Set-Cookie header if they parse and execute the JavaScript in the first place and make the AJAX request. This is far, far more work than most spammers are willing to go through, especially since the work only applies to a single site. The biggest downside is that anyone with JavaScript off or cookies disabled gets marked as potential spam. Which means that moderation queues are still a good idea.

从理论上讲，这可以作为通过模糊性的安全，但在实践中，这是很好的。

我从未见过垃圾邮件发送者试图破解这种技术，尽管可能每隔几个月我就会收到一个手动输入的主题垃圾邮件条目，这有点怪异。

If the main issue with not using images for the captcha is the CPU load of creating those images, it may be a good idea to figure out a way to create those images when the CPU load is "light" (relatively speaking). There's no reason why the captcha image needs to be generated at the same time that the form is generated. Instead, you could pull from a large cache of captchas, generated the last time server load was "light". You could even reuse the cached captchas (in case there's a weird spike in form submissions) until you regenerate a bunch of new ones the next time the server load is "light".

验证码过滤器的一个理论想法。向用户提出一个服务器可以简单回答的问题，用户也可以回答。共享答案成为用户和服务器都知道的一种公钥。

Stack Overflow的相关示例:

用户XYZ有多少声誉点?

提示:查看屏幕侧面的信息，或者点击这个链接。 用户可以从已知的堆栈溢出用户中随机抽取。

一个更一般的例子: 你住在哪里? 你住的地方星期六九点天气怎么样? 提示:使用雅虎天气，并提供湿度和一般条件。

然后用户输入他们的答案

西雅图 部分多云，湿度85%

计算机证实确实是西雅图当时的天气状况。

答案对用户来说是唯一的，但服务器有一种查找和确认答案的方法。

问题的类型可以多种多样。但其思想是，您对人类必须查找的事实组合进行一些处理，服务器可以简单地进行查找。这个过程是一个两部分的对话，需要一定程度的相互理解。这是一种反向转弯测试。让人类证明它可以提供可计算的数据，但它需要人类的知识来产生可计算的数据。

另一种可能的实现。你叫什么名字，什么时候出生的?

人会提供一个已知的答案，计算机可以在数据库中查找信息。

也许一个数据库可以由一个机器人来填充，但机器人需要一些智能来把相关的事实放在一起。服务器端的数据库或查找表可以被系统地删除明显的垃圾信息，如属性。

I am sure that there are flaws and details to be worked out in the implementation. But the concept seems sound. The user provides a combination of facts that the server can lookup, but the server has control over the kind of combinations that should be asked. The combinations could be randomized and the server could use a variety of strategies to lookup the shared answer. The real benefit is that you are asking the user to provide some sort of profiling and revelation of themselves in their answer. This makes it all the more difficult for bots to be systematic. A bunch of computers start using the same answers across many servers and captcha forms such as

我是1972年下午3:45出生的机器人。

然后，这种响应可以被整个网络分析和使用，以阻止机器人，有效地使自动化在几次迭代后变得毫无价值。

As I think about this more it would be interesting to implement a basic reading comprehension test for commenting on blog posts. After the end of a blog post the writer could pose a question to his or her readers. The question could be unique to each blog post and it would have the added benefit of requiring users to actually read before commenting. One could write the simple question at the end of a post with answers stored server side and then have an array of non sense questions to salt the database.

这篇文章谈到紫色验证码技术了吗? 服务器端回答(false, no)

这篇文章是关于验证码的吗? 服务器端回答(是，是)

这篇文章是关于迈克尔·杰克逊的吗? 服务器端回答(false, no)

以随机的顺序提出几个问题，并使这个顺序有意义，这似乎很有用。例如，上面的would = no, yes, no。打乱顺序，问一些无意义的问题，答案是“不是”和“是”。