How I Built a Custom Anti-Spam Rate Limiter for My PHP Site (No Cloudflare

If you run a free directory, the bots will find you. Within 48 hours of launching my free toolbox, I was getting hammered by automated scripts.

I decided to ditch heavy WAF rules and build a custom rate limiter using pure vanilla PHP 8 with flat JSON files. No Redis, no database overhead.

Here is how it works in 3 layers:

1. The Honeypot & Time Check
   I added a hidden input field (bots fill it, humans don't). If filled, instant ban. I also record page load time. If a user submits in under 5 seconds, they are a bot.

2. Flat-File IP Rate Limiting
   Instead of querying the database on every attempt, I store IP timestamps in a JSON file (ip_limits.json). If an IP submits more than 3 times in 24 hours, I block them before any SQL runs.

3. The Server-Side Math CAPTCHA
   I generate two random numbers in a PHP session and ask the user to solve it (e.g., "What is 4 + 7?"). Scripts hate dynamic math.

The Result:
Spam submissions dropped to absolute zero. Real users don't notice a thing. A few lines of vanilla PHP saved me hours of headaches.

I'm currently building Site Tools Box, a free ad-free platform with 20+ developer tools and an AI Text Humanizer. You can see this anti-spam system in action here:
👉 sitetoolsbox.com

Have you ever fought a bot war on your own site? Let me know!