I like hidden-captcha  a lot. It's invisible to visitors but is pretty effective against bots. I have one bot a day that gets through.

I've also added a mandatory profile question. The label on mine just says "say something so i know you're real". The bots insert junk.

If you have a commercial site, CDN and DDoS blocking services like Cloudflare and DosArrest block bots because the bots don't have the same connection signature. Plus you get the performance upgrades of a CDN and site monitoring.

--
-Don Pickerel-
Fane Software


I am working on a new site (Drupal 7) and I have reCaptcha module installed which includes the image captcha as well. This still isn't keeping out the gnats trying to get logins. I have the site set that all new users need to verified with a valid email and the admin needs to authorize the new user but it still hasn't stopped them. I am looking for other ideas where I can limit these issues. I am getting about 15 a day and they seem to be growing. 
I have a few mandatory fields setup but I don't want to make it totally a pain for new users to put in the valid info.

This might be just a cost of having the thing open for new users but if anyone can give me some other ideas on how to stem the tide I would appreciate it.

Thanks in advance.

--
John J. Boris, Sr.
Online Services
www.onlinesvc.com