Spammer protection?

Question

CMS

I'm trying to reduce the number of spam registrations on the site.
I noticed the following:
- when I register myself, then $_SERVER, among other things, contains the following data:

[HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
[HTTP_COOKIE] => dle_newpm=0; _ym_uid=145052032953; PHPSESSID=n2do411r6h5rrk5; _ym_isad=0; DreamCashID=2x9zjnb78b2fw4cxakkf39kw525u; _gat=1; MarketGidStorage=%7B%223A%7B%22svspr%22%3A%22https%3A%2F%2Fwww.google.ee%2F%22%2C%22svsds%22%3A3%2C%22TMTQ%22C595190%22%3A%7B%22page%22%22time%22%3A1458034%7D%7D; _ga=GA139895609; _ym_visorc_1w

And when "bots" or what they are are registered, then $_SERVER contains:

[HTTP_ACCEPT] => */*
[HTTP_PRAGMA] => no-cache

What do you think about this? Under what conditions can [HTTP_ACCEPT] and [HTTP_PRAGMA] take on such a value? As I understand it, these variables should contain data from 99.9% of real users of computers, tablets and phones.
Is it possible to weed out bots this way?
Do I run the risk of cutting off real users by filtering them according to such conditions?

Answer 1

[HTTP_ACCEPT] => */*- no browser puts such headers, so you can filter by them.
But I think the simplest and most reliable way would be such a recaptcha in the registration form and where the bots are raging:
https://www.google.com/recaptcha/intro/index.html
You can also add a hidden input to the registration form and write there using javascript value and if the sent value does not correspond to what it should be, then it means that the bot has registered - bots usually do not execute javascript. A kind of javascript captcha - quite reliable in my experience (more reliable than captcha where you need to recognize the text).
Simple example:
form

<form .....>
<input id="login_tt" type="hidden" name = "login_tt"> // Сюда будем записывать секретное значение через js
</form>
<script>
$("#login_tt").val("my secret value") // само значение которое будем проверять на сервере
</script>

on the server like this

<?php
     if( $_POST["login_tt"] != "my secret value"){
      exit(0);
    }

Answer 2

*/* in Accept: most often occurs when accessing the browser through a proxy, and in some cases - when refreshing the page in the browser. That is, there is a chance to kill a certain number of legal clients. Better put a captcha on registration.
PS Pragma: no-cache is also set when requesting through a proxy.

Answer 3

any cURL without settings will give this, I’m not talking about the same python http clients at all

Answer 4

If the user is not intentionally trying to be anonymous, cookies will work. When you see a suspicious header (or some other characteristic feature/activity), you can act like Yandex: offer to enter a captcha.

Answer 5

Maybe it's stupid search engine bots?