Developer finds plain-text captcha blocked humans, not bots after spam bypass

A developer running a personal blog discovered that all four of his anti-spam layers — a honeypot field, CSRF token, IP-based rate limit, and a plain-text math captcha — were cleanly bypassed by a spam bot promoting car rentals. The bot succeeded because it behaved like a legitimate browser: it loaded the page, left the honeypot empty, retrieved a valid CSRF token, posted only once, and extracted the captcha answer directly from the HTML source. The developer later replicated the entire bypass himself in under three minutes using a simple bash script, confirming the vulnerability. The core flaw was that none of the four layers examined the actual content of the comment, only whether the submission appeared to come from a human user. He subsequently patched all three comment-handling PHP files with regex rules to reject external links and known spam keywords, addressing the content-blind gap in his system.