Bot Block for Forms

Search engines and other robots will follow form action URLs. Unless a technique like this simple one is used.

When bots follow form action URLs, it looks like automated submission attempts to forms sensitized for that. For other forms, it may actually result in submissions and the bots getting the thank-you page.

Willmaster.com has been around for 14 years. Many, many bots visit the site. Sometimes the logs look like we're hosting a bot party.

To assuage my annoyance about receiving all those automated attempt and form submission notices, I came up with a simple solution.

It turns out to be effective form spam prevention, too.

How It Works

The URL is removed from the form's action value. Bots have nothing to follow.

JavaScript below the form restores the action value to the correct URL. It works for people like it should.

Alternatively, if you want to provide a URL for bots to follow, assign the URL to the form's action attribute. The JavaScript below the form will replace it with the correct URL for people.

Implementing the Technique

Implementation is two steps.

1. Remove the form action value.

   Make a note of the form action's URL (you'll use it in step two). Then delete the URL from the action's value.

   Important: The form tag needs an id value for this technique to work. If your form tag doesn't have an id, give it one.

   As an example, let's suppose this is your form tag.

   <form id="myform" method="post" action="myscript.php">
   
   

   Make a note of the URL "myscript.php" to be used in step two. Then delete the URL from the action's value.

   <form id="myform" method="post" action="">
   
   

   Robots now have nothing to follow.

   If you want to feed a URL to the robots, replace the action URL with the URL to feed (instead of just deleting the action URL).

2. Use JavaScript to restore the action value.

   Somewhere below the form (anywhere between the closing </form> tag to the end of the page), insert this JavaScript. The customization notes follow.

   <script type="text/javascript">
   var formID = "myform";
   var actionURL = "myscript.php";
   document.getElementById(formID).action = actionURL;
   </script>
   
   

   Javascript customization notes:

   1. Replace myform with the id value of your form tag.

   2. Replace myscript.php with the original form action URL – the URL you made a note of in the first implementation step.

Because JavaScript is used, it may be prudent to include a note for JavaScript-disabled browsers. Example:

<noscript>
<h4>JavaScript is required to use this form.</h4>
</noscript>

Only bots and JavaScript-disabled browsers and robots will see the content between the noscript tags.

Testing

Test your form after implementing the technique. Verify it still works as it should.

You now have good bot-blocking protection to prevent search engine spiders from following form action URLs and to reduce spam from automatically-submitted forms.

Will Bontrager