Complete Spam Prevention Guide for Contact Forms: Stop All Unwanted Messages

<?php
// master-spam-prevention.php - Complete spam prevention implementation

require_once 'vendor/autoload.php';

class MasterSpamPrevention {
    private $spamFilter;
    private $contentModerator;
    private $rateLimiter;
    private $captchaValidator;
    private $honeypotValidator;
    private $ipBlacklist;
    private $config;
    
    public function __construct($config = []) {
        $this->config = array_merge($this->getDefaultConfig(), $config);
        $this->initializeComponents();
    }
    
    /**
     * Main spam prevention check - run all validations
     */
    public function validateSubmission($formData, $serverData) {
        $results = [
            'allowed' => false,
            'risk_score' => 0,
            'reasons' => [],
            'actions_taken' => [],
            'confidence' => 0
        ];
        
        try {
            // 1. IP Blacklist Check (highest priority)
            $ipCheck = $this->ipBlacklist->shouldBlockIP($serverData['REMOTE_ADDR']);
            if ($ipCheck['blocked']) {
                $results['reasons'][] = 'IP address blocked';
                $results['risk_score'] += 100;
                $results['actions_taken'][] = 'ip_blocked';
                return $this->finalizeResults($results);
            }
            
            // 2. Rate Limiting Check
            $rateLimitCheck = $this->rateLimiter->isRateLimited(
                $serverData['REMOTE_ADDR'],
                $formData['email'] ?? null,
                0 // Initial suspicious score
            );
            
            if ($rateLimitCheck['limited']) {
                $results['reasons'][] = $rateLimitCheck['reason'];
                $results['risk_score'] += 75;
                $results['actions_taken'][] = 'rate_limited';
                return $this->finalizeResults($results);
            }
            
            // 3. Honeypot Validation
            $honeypotCheck = $this->honeypotValidator->validateHoneypots($formData, $serverData);
            if ($honeypotCheck['is_bot']) {
                $results['reasons'] = array_merge($results['reasons'], $honeypotCheck['reasons']);
                $results['risk_score'] += $honeypotCheck['confidence'];
                $results['actions_taken'][] = 'honeypot_triggered';
            }
            
            // 4. CAPTCHA Validation
            if (!empty($formData['recaptcha_token'])) {
                $captchaCheck = $this->captchaValidator->validateSubmission(
                    $formData['recaptcha_token'],
                    $formData['behavior_data'] ?? null,
                    $serverData['REMOTE_ADDR']
                );
                
                if (!$captchaCheck['valid']) {
                    $results['reasons'] = array_merge($results['reasons'], $captchaCheck['reasons']);
                    $results['risk_score'] += 50;
                    $results['actions_taken'][] = 'captcha_failed';
                }
            }
            
            // 5. Content Moderation
            $contentText = $formData['message'] . ' ' . ($formData['subject'] ?? '');
            $moderationCheck = $this->contentModerator->moderateContent($contentText);
            
            if (!$moderationCheck['is_appropriate']) {
                $results['reasons'] = array_merge($results['reasons'], $moderationCheck['issues']);
                $results['risk_score'] += ($moderationCheck['severity'] === 'high' ? 80 : 40);
                $results['actions_taken'][] = 'content_moderated';
            }
            
            // 6. Spam Filter Analysis
            $spamCheck = $this->spamFilter->isSpam($formData);
            if ($spamCheck['is_spam']) {
                $results['reasons'] = array_merge($results['reasons'], $spamCheck['reasons']);
                $results['risk_score'] += $spamCheck['score'];
                $results['actions_taken'][] = 'spam_detected';
            }
            
            // 7. Final Decision Logic
            $results = $this->finalizeResults($results);
            
            // 8. Log the submission for analysis
            $this->logSubmission($formData, $serverData, $results);
            
            // 9. Take additional actions if needed
            if (!$results['allowed']) {
                $this->handleBlockedSubmission($serverData['REMOTE_ADDR'], $results);
            }
            
            return $results;
            
        } catch (Exception $e) {
            error_log("Spam prevention error: " . $e->getMessage());
            
            // Fail securely - block if unsure
            return [
                'allowed' => false,
                'risk_score' => 100,
                'reasons' => ['System error - blocking for security'],
                'actions_taken' => ['system_error'],
                'confidence' => 100
            ];
        }
    }
    
    private function finalizeResults($results) {
        // Calculate final decision
        $maxAllowedRisk = $this->config['max_risk_score'];
        $results['allowed'] = $results['risk_score'] < $maxAllowedRisk;
        
        // Calculate confidence
        $results['confidence'] = min(100, max(0, $results['risk_score']));
        
        // Add recommendation
        if ($results['risk_score'] >= 80) {
            $results['recommendation'] = 'block';
        } elseif ($results['risk_score'] >= 50) {
            $results['recommendation'] = 'manual_review';
        } else {
            $results['recommendation'] = 'allow';
        }
        
        return $results;
    }
    
    private function handleBlockedSubmission($ip, $results) {
        // Increment violation counter
        $this->rateLimiter->recordViolation($ip);
        
        // Add to temporary blacklist if risk is very high
        if ($results['risk_score'] >= 90) {
            $this->ipBlacklist->addTemporaryBlock($ip, 3600); // 1 hour block
        }
        
        // Send alert if needed
        if ($this->config['admin_alerts'] && $results['risk_score'] >= 85) {
            $this->sendAdminAlert($ip, $results);
        }
    }
    
    private function logSubmission($formData, $serverData, $results) {
        $logEntry = [
            'timestamp' => date('Y-m-d H:i:s'),
            'ip' => $serverData['REMOTE_ADDR'],
            'user_agent' => $serverData['HTTP_USER_AGENT'] ?? '',
            'allowed' => $results['allowed'],
            'risk_score' => $results['risk_score'],
            'reasons' => $results['reasons'],
            'actions_taken' => $results['actions_taken'],
            'form_data_hash' => hash('sha256', json_encode($formData)),
            'country' => $results['country'] ?? null
        ];
        
        // Log to file or database
        file_put_contents(
            $this->config['log_file'],
            json_encode($logEntry) . "\n",
            FILE_APPEND | LOCK_EX
        );
    }
    
    private function sendAdminAlert($ip, $results) {
        $subject = "High-Risk Contact Form Submission Blocked";
        $message = "A high-risk submission was blocked:\n\n";
        $message .= "IP: {$ip}\n";
        $message .= "Risk Score: {$results['risk_score']}\n";
        $message .= "Reasons: " . implode(', ', $results['reasons']) . "\n";
        $message .= "Time: " . date('Y-m-d H:i:s') . "\n";
        
        mail($this->config['admin_email'], $subject, $message);
    }
    
    private function initializeComponents() {
        $this->spamFilter = new SpamFilter();
        $this->contentModerator = new ContentModerator();
        $this->rateLimiter = new AdvancedRateLimiter();
        $this->captchaValidator = new CaptchaValidator($this->config['recaptcha_secret']);
        $this->honeypotValidator = new HoneypotValidator();
        $this->ipBlacklist = new IPBlacklist($this->config['geo_api_key']);
    }
    
    private function getDefaultConfig() {
        return [
            'max_risk_score' => 50,
            'admin_alerts' => true,
            'admin_email' => 'admin@yoursite.com',
            'log_file' => __DIR__ . '/logs/spam_prevention.log',
            'recaptcha_secret' => '',
            'geo_api_key' => '',
            'strict_mode' => false
        ];
    }
    
    /**
     * Generate secure contact form HTML with all protection measures
     */
    public function generateSecureForm() {
        $honeypots = $this->honeypotValidator->generateDynamicHoneypots();
        $customCaptcha = $this->captchaValidator->generateCustomCaptcha();
        
        return $this->renderFormHTML($honeypots, $customCaptcha);
    }
    
    private function renderFormHTML($honeypots, $customCaptcha) {
        return '
        <form id="secureContactForm" method="POST" action="process-secure-contact.php">
            <!-- Visible Fields -->
            <div class="form-group">
                <label for="name">Full Name *</label>
                <input type="text" id="name" name="name" required>
            </div>
            
            <div class="form-group">
                <label for="email">Email Address *</label>
                <input type="email" id="email" name="email" required>
            </div>
            
            <div class="form-group">
                <label for="subject">Subject *</label>
                <input type="text" id="subject" name="subject" required>
            </div>
            
            <div class="form-group">
                <label for="message">Message *</label>
                <textarea id="message" name="message" required></textarea>
            </div>
            
            <!-- Security Fields -->
            ' . $this->generateHoneypotFields($honeypots) . '
            
            <!-- Timing and Behavior Tracking -->
            <input type="hidden" name="form_start_time" id="form_start_time">
            <input type="hidden" name="js_enabled" value="false" id="js_enabled">
            <input type="hidden" name="mouse_moved" value="false" id="mouse_moved">
            <input type="hidden" name="keyboard_used" value="false" id="keyboard_used">
            <input type="hidden" name="behavior_data" id="behavior_data">
            
            <!-- Custom CAPTCHA -->
            <div class="form-group">
                <label>' . $customCaptcha['question'] . '</label>
                <input type="number" name="captcha_answer" required>
                <input type="hidden" name="captcha_hash" value="' . $customCaptcha['hash'] . '">
            </div>
            
            <!-- reCAPTCHA Token -->
            <input type="hidden" id="recaptcha_token" name="recaptcha_token">
            
            <button type="submit">Send Message</button>
        </form>
        
        <script>
            // Initialize security tracking
            document.addEventListener("DOMContentLoaded", function() {
                const form = document.getElementById("secureContactForm");
                
                // Set form start time
                document.getElementById("form_start_time").value = Math.floor(Date.now() / 1000);
                document.getElementById("js_enabled").value = "true";
                
                // Track user behavior
                let mouseMoves = 0, keystrokes = 0, scrolls = 0;
                
                document.addEventListener("mousemove", function() {
                    mouseMoves++;
                    document.getElementById("mouse_moved").value = "true";
                });
                
                document.addEventListener("keydown", function() {
                    keystrokes++;
                    document.getElementById("keyboard_used").value = "true";
                });
                
                document.addEventListener("scroll", function() {
                    scrolls++;
                });
                
                // Form submission
                form.addEventListener("submit", function(e) {
                    e.preventDefault();
                    
                    // Collect behavior data
                    const behaviorData = {
                        mouse_movements: mouseMoves,
                        keystrokes: keystrokes,
                        scrolls: scrolls,
                        time_spent: Date.now() - (parseInt(document.getElementById("form_start_time").value) * 1000),
                        screen_resolution: screen.width + "x" + screen.height,
                        timezone: Intl.DateTimeFormat().resolvedOptions().timeZone
                    };
                    
                    document.getElementById("behavior_data").value = JSON.stringify(behaviorData);
                    
                    // Get reCAPTCHA token if available
                    if (typeof grecaptcha !== "undefined") {
                        grecaptcha.execute("YOUR_SITE_KEY", {action: "contact_form"}).then(function(token) {
                            document.getElementById("recaptcha_token").value = token;
                            form.submit();
                        });
                    } else {
                        form.submit();
                    }
                });
            });
        </script>';
    }
    
    private function generateHoneypotFields($honeypots) {
        $html = '';
        foreach ($honeypots as $honeypot) {
            $html .= '<div style="' . $honeypot['style'] . '">';
            $html .= '<label for="' . $honeypot['name'] . '">Leave blank</label>';
            $html .= '<input type="' . $honeypot['type'] . '" id="' . $honeypot['name'] . '" name="' . $honeypot['name'] . '" tabindex="-1" autocomplete="off">';
            $html .= '</div>';
        }
        return $html;
    }
}

// Usage Example
try {
    $spamPrevention = new MasterSpamPrevention([
        'max_risk_score' => 50,
        'admin_email' => 'admin@yoursite.com',
        'recaptcha_secret' => 'your-recaptcha-secret-key',
        'strict_mode' => true
    ]);
    
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        $validationResult = $spamPrevention->validateSubmission($_POST, $_SERVER);
        
        if ($validationResult['allowed']) {
            // Process legitimate submission
            echo json_encode([
                'success' => true,
                'message' => 'Thank you! Your message has been sent.'
            ]);
        } else {
            // Block spam
            http_response_code(429); // Too Many Requests
            echo json_encode([
                'success' => false,
                'message' => 'Your submission has been flagged as spam.',
                'risk_score' => $validationResult['risk_score']
            ]);
        }
    } else {
        // Display form
        echo $spamPrevention->generateSecureForm();
    }
    
} catch (Exception $e) {
    error_log("Critical spam prevention error: " . $e->getMessage());
    http_response_code(500);
    echo json_encode([
        'success' => false,
        'message' => 'System error. Please try again later.'
    ]);
}
?>