For full details of how CFFormProtect works, see the project page at http://cfformprotect.riaforge.org/

Installation

1. Copy the cfformprotect folder into your web root.
2. Put <cfinclude template="/cfformprotect/cffp.cfm"> somewhere between your form tags.
3. On your processing page include the following code:
   <cfset Cffp = CreateObject("component","cfformprotect.cffpVerify").init() />
   <!--- now we can test the form submission --->
   <cfif Cffp.testSubmission(form)>
   <!--- The submission has passed the form test. Place processing here --->
   <cfelse>
   <!--- The test failed. Take appropriate failure action here. --->
   </cfif>
4. Setup your email settings and Akismet in cffp.ini.cfm, if you want to use those features (if you leave the email settings blank, you won't receive an email when spammer tries to attack your forms)

Customization

- You can change the values in cffp.ini.cfm if you want to tweak how CFFormProtect operates. Descriptions of the values are below.
- You'll probably want to change what happens when a spam message is found. I have it set to display an error, send you an email (if you configured this feature) and then cfabort. You can change this at the bottom of cffpVerify.cfm. You can use two variables for information on why the message was flagged as spam, testsThatFailed and totalPoints. This will help you tweak the settings to your liking (to allow more or less messages through)
- If you use the Akismet feature, modify your site's "send email" code that sends you good emails, so that it contains the Akismet link to notify Akismet of spam that got through their filters. This step is optional but very recommended, because Akismet is free, and all they ask is that you feed data back into the system when necessary to help them improve it. Here is the code I have in my sites for this:

      <cfif Cffp.getConfig().akismet>
      	<!--- The following few lines build the URL to allow the user to submit a missed spam notification to Akismet if this is not spam --->
      	<cfset missedSpamURL = replace("#Cffp.getConfig().akismetBlogURL##cffpPath#/akismetFailure.cfm?type=spam","://","^^","all")>
      	<cfset missedSpamURL = replace(missedSpamURL,"//","/","all")>
      	<cfset missedSpamURL = replace(missedSpamURL,"^^","://","all")>
      	<cfset missedSpamURL = missedSpamURL&"&user_ip=#urlEncodedFormat(cgi.remote_addr,'utf-8')#">
      	<cfset missedSpamURL = missedSpamURL&"&referrer=#urlEncodedFormat(cgi.http_referer,'utf-8')#">
      	<cfset missedSpamURL = missedSpamURL&"&comment_author=#urlEncodedFormat(form[Cffp.getConfig().akismetFormNameField],'utf-8')#">
      	<cfif Cffp.getConfig().akismetFormEmailField neq "">
      		<cfset missedSpamURL = missedSpamURL&"&comment_author_email=#urlEncodedFormat(form[Cffp.getConfig().akismetFormEmailField],'utf-8')#">
      	</cfif>
      	<cfif cffpConfig.akismetFormURLField neq "">
      		<cfset missedSpamURL = missedSpamURL&"&comment_author_url=#urlEncodedFormat(form[cffpConfig.akismetFormURLField],'utf-8')#">
      	</cfif>
      	<cfset missedSpamURL = missedSpamURL&"&comment_content=#urlEncodedFormat(form[cffpConfig.akismetFormBodyField],'utf-8')#">
      	<p>Akisment thinks this is not spam, if it is please mark this as
      	missed spam by <cfoutput><a href="#missedSpamURL#">clicking here</a></cfoutput>.</p>
      </cfif>

Tip: You can enter "viagra-test-123" as your Name when testing your form, and Akismet will automatically mark the form submission as spam

INI File settings (cffp.ini.cfm)
Most of the values can be left as default, if you want, but you'll need to provide values for Akismet if you want to use that test.

The first section of the ini allows you to set which tests to run. 1 is enabled and 0 is disabled :

- mouseMovement
  - enable/disable the mouse test. This test makes sure the user moved thier mouse
- usedKeyboard
  - enable/disable the keyboard test. this test makes sure the user used their keyboard
- timedFormSubmission
  - enable/disable the test to check how long the form entry and submission took
- hiddenFormField
  - enable/disable hidden form field test. this test makes sure a CSS hidden form field is empty
- akismet
  - enable/disable the akismet test. uses the public Akismet service to test if form contents are spam. This is off by default, because you have to provide the details in the second section for Akistmet to work.
- tooManyUrls
  - enable/disable the tooManyUrls test. this test will add up the number of URLs that are found in all of the submitted form fields, and mark the submission as spam if the total exceeds the limit configured by the tooManyUrlsMaxUrls variable in the ini file. This test was created by Dave Shuck.
- teststrings
  - enable/disable the teststrings test. this test will compare the words in the form submission to a list of configurable "spammy" words, and mark the submission as spam if one of these words is found. you can modify the list by editing the spamstrings variable in the ini file. This test was created by Mary Jo Sminkey.

The 2nd section has settings for individual tests. All of the Akisment settings are left blank on purpose. If you want to use Akismet (highly recommended), please fill in these variables to match your environment

- timedFormMinSeconds
  - the minimum seconds allowed for a user to fill out the form
- timedFormMaxSeconds
  - the maximum seconds allowed for a user to fill out the form
- encryptionKey
  - used in the timedForm test, to encrypt the time so it can be stored in a hidden form field (to help fool the spammers)
- akismetAPIKey
  - this is the api key that you recieved from Akismet. it's blank by default, because you have to get your own! ;)
- akismetBlogURL
  - put the URL for your site here, it's a required value for the Akismet service
- akismetFormNameField
  - the name of your "Name" form field
- akismetFormEmailField
  - the name of your "Email address" form field (optional)
- akismetFormURLField
  - the name of your "URL" form field (optional)
- akismetFormBodyField
  - the name of your "Comment" form field
- tooManyUrlsMaxUrls
  - the maximum amount of URLs that can be passed in the form contents
- spamstrings
  - a list of strings that form contents will be compared to

The 3rd section allows you to modify how many penalty points each test failure will receive

failureLimit, is the total amount of points you will allow before flagging a message as spam. Each test that fails will assign 'failure points' to the form submission (see 3rd section of ini file). If the total points exceeds the failureLimit, the message will not be sent.

The 4th section allows you to setup your email settings if you want to have spam reports sent to you as they occur. Set emailFailedTests to '1' if you want this feature enabled

The final section allows you to setup logging. By default, any failed spam submissions will be logged to your server's default cflog location.

logFailedTests, enable/disable logging of spam submissions

logFile, if you don't want to use the default cflog log file, you can specify a different log file name here

CFFormProtect is governed by the mozilla public license version 1.1.
See the included License.txt or http://www.mozilla.org/MPL/ for details