Fairly simple: not having CAPTCHAs. By including them you externalise your business costs onto your users.

So how do you stop bots from submitting fake data to sign up forms or trying to brute force password fields etc. on websites?

For passwords: offer 2FA (ideally WebAuthn, but it sadly hasn’t landed in enough browsers yet), use a reasonable password strength policy, and possibly consider OAuth login. Or, and I know this is crazy talk, allow users to opt out of the bloody captcha if they say they use a password manager, and then use some basic heuristic requirements on the password.

But stop making me click the friggin’ stop lights every time I log in to my own account.

> brute force password fields

rate limit

> stop bots from submitting fake data to sign up forms

I don't think there's an universal solution here. it depends on the application itself and why you consider fake signups an issue in the first place.

Rate limit by what? Username? IP?

per user if you want to defend against targeted attacks. per IP if you want to prevent untarged attacks. so, both.

add an email-reset for the limit so users can't be locked out of their accounts by a DoS.

Circuit-break after 5-10 failed attempts and require 30s or 1m before each attempt after the first 3 failed ones.

To stop fake signups, require confirming the email address and only allow some number of signups per IP per day. It's not perfect but neither are CAPTCHAs and either way you can probably stop most spam, if it's even a problem for you.

Something I have found to work well is simply adding a hidden input field to forms. Since just about every spam bot automatically fills every field and submits, you can just disregard any submission which has that field populated and there is zero interruption to normal users.

I've used this tactic for years and sadly it's not remotely helpful for any of my websites anymore. The bots only get better over time. Many are also running PhantomJS, headless Chrome, or similar.

It was only a matter of time!

I imagine using a standard text field and then hiding it using css probably works much better than setting a type=“hidden” field. I also usually use something like name=“phone” and then just naming the actual phone field something else, if needed.

Except then, you have autofill/extensions that form fill for you.

Generating simple math question/answer can work well enough to keep out non-targeted traffic (someone not targeting a bot tailored to your site).

Amazon & Google itself(login) uses old squiggly-text captchas. Try wrong password 2-3 times to be greeted by one.