SPF30 is a PHP script for preventing spam submissions via web forms, which uses well established techniques for securing form data and hardening the form submission process against automated spam bots. It works by adding a secret key, the current date, and the user’s user agent to all form submissions.

All form submissions can have a period after which they'll expire, or can be ignored if they are submitted after very quick intervals in succession. Also it adds hidden fields to the form, so bots can unmask themselves by interacting with them. Many other features are also supported.

Requirements
- You must have the PHP mcrypt module installed.
- The frontend form display requires jQuery to be loaded as it binds form submission to frontend encryption.

Features of SPF30:
- The form submission contains a hashed value of a system defined secret key, the current date, and the user’s user agent.
- The form submission is invalidated in the event the submission timestamp exceeds a specific timeout period (default 1 hour).
- The form submission is invalidated in the event it was submitted in rapid succession (default 5 seconds).
- A hidden input honeypot is utilized in an attempt to trick bots into passing data with the field.
- A hidden hash field is validated against the submission time, user agent, and secret key.
- A hidden field is sent containing a the array of encrypted fields for decryption to their old field names.
- Decrypted form fields are written directly back to the POST array, abstracting the encryption from your backend handling.
- User specified form field names can undergo two-way DES encryption to obfuscate form field names.
- User submitted form field values can be encrypted on the frontend using a Javascript implementation of DES.
- The encryption method goes beyond simple DES encryption for the purposes of transporting UTF-8 characters in POST data.