If AI bots are spamming your site's contact form, I found a solution that doesn't use captcha

[William Seger]

4. I don't want to block web crawlers; I just don't want them spamming me

Since I started blocking IPs, the attempts that my hack has logged has slowed down -- 9 yesterday, only 3 today -- and none have gotten through. But I'm not going to keep blocking every IP that I see -- too much trouble, and really not worth the time it would take. I'll just check the log every once in a while to see how many repeat offenders there are, but it's possible that the IPs I see in REMOTE_ADDR are spoofed anyway.

Next, I'm thinking of doing something similar for my login script, which receives dozens of hits per day with bogus email addresses and random-character passwords. I have no idea what the deal is with that -- it isn't a SQL injection attack or anything like that, just totally bogus credentials that always fail. Sometimes there are multiple attempts within a few minutes from the same IP with different credentials. I log the failures, and I've noticed that an uncomfortable number of them are from Russia, China, and other countries that are known for hacking, and the fact that I don't know what they're up to disturbs me, even though it seems pointless.