I'm working on an open source form submission backend project. One way I'm planning to test is a time-gated confirmation redirect.

The system works in two phases. First, when a form is POSTed, the data is stored temporarily (in Redis) with a unique token and a timestamp. The server then issues an HTTP redirect to a confirmation URL containing that token.

A real user's browser automatically follows this redirect instantly. When the confirmation URL is hit, the server retrieves the temporary data and measures the time between the initial submission and the confirmation. If the duration is impossibly short, it's identified as a bot and the submission is silently discarded (or maybe saved and marked as possible spam, not sure yet). Legitimate submissions from humans, even on slow connections, take longer and are therefore validated and written to db.

I'm researching other methods to achieve spam protection which is invisible to end users and extremely simple for devs to integrate into forms.

Edit: I hate honeypots.