Is this system to block bots reliable?

Question

I've got a page which contains a form: when page is requested, a session is stored:

$_SESSION['ok']=date("His");

Plus, the form contains this hidden field:

<input type="text" name="email-confirm" id="email-confirm" style="display:none;" placeholder="Do not fill this field">

When user sends the form, the following PHP code is launched to check if they're not a bot:

session_start();
if(!isset($_SESSION['ok'])){die('Error: you have to enable cookies in order to make everything work fine.');} 
$fast = date("His") -4;
if($fast < $_SESSION['ok']){$_SESSION['banned']=1;
die('Woah, that was fast! Would you mind doing a little captcha verification? Refresh the page to continue.');}
if(!empty($_POST['email-confirm'])){$_SESSION['banned']=1;
die('You\'ve been temporarily banned.<br>
Refresh the page to lift the ban with a captcha verification.');
}

If session 'banned' is set and user tries to visit any page on the site, they're asked to complete a captcha challenge which relies on google recaptcha.

Is this method to block bots reliable?
I don't like very much the idea to ask every user to complete a captcha verification, because I feel like it would be annoying to do that every time, but if it's the only method to be really safe, then I'd adopt it.

Answer 1

Firstly your formatting looks god awful - I hope that this is just from pasting it here.

Then you should rename your session variable. It isn't ok it's the time of last request - so $_SESSION['lastRequest'] seems like a good name. Also that 4 seconds shouldn't be just some random number but a named constant that is used in all places and then can be changed easily.

Now about the effectiveness:
I don't know what the latest advancements in the bot-scene are. However I'm quite certain that XRumer still is one of the better ones, so I'll try to match your system against that.

Your strongest protection is the captcha. There always are claims that those are bypassed - you can half the boasted recognition rate and probably still be on the safe side.

Your email-confirm trick is easily detectable - just check for the display:none and not fill it out.
Whether that is actually done depends on some factors:

• Whether the bot is even able to do this. But detecting the trick in the current form isn't hard - I'm quite certain XRumer is able to detect that.
• Whether the bot WANTS to do that. Spamming is only about volume. Parsing the site to detect such cheap tricks takes time, memory and CPU load.
  Most probably the spammers do not care about your site in particular; They might set their spambot to the fastest mode and blast away. Maybe at different times the bot is configured to try the best it can to post its message - and your current trick fools no one.

However you can just create another CSS id for the hidden fields and use that. As said, spamming is mostly done as quick as possible. Downloading and parsing further files is avoided - and I'm certain it will stay that way.

So in conclusion: It may not stop everything, but it will stop a lot.