Various improvements

and now: the patch

+++ b/honeypot.admin.inc
@@ -96,6 +96,16 @@ function honeypot_admin_form($form) {
+

The above code adds support for profile module. Not much to say. I've found that the "protect" all forms setting doesn't work well on drupal.org as it has too many that are exposed to anon users.

+++ b/honeypot.install
@@ -41,3 +44,60 @@ function honeypot_update_6100() {
+

The above code adds a table to track failed submissions by registered users.

+++ b/honeypot.install
@@ -41,3 +44,60 @@ function honeypot_update_6100() {
+

Schema definition for installation time. I didn't test it on a fresh install.

+++ b/honeypot.module
@@ -45,6 +45,9 @@ function honeypot_form_alter(&$form, &$form_state, $form_id) {
 

I've added three forms that IMO shouldn't be protected. I am ok with not havign this submitted.

+++ b/honeypot.module
@@ -72,6 +75,13 @@ function honeypot_form_alter(&$form, &$form_state, $form_id) {
+

The cronjob removes faied submit events from the table. The expiration time is fairly conservative. There is no UI for it.

+++ b/honeypot.module
@@ -183,12 +193,14 @@ function _honeypot_time_restriction_validate($form, &$form_state) {
 

I made the time limit stuff a bit more flexible.

+++ b/honeypot.module
@@ -183,12 +193,14 @@ function _honeypot_time_restriction_validate($form, &$form_state) {
+    $time_limit = honeypot_get_time_limit();

The time limit got possibly increased, we need to get the new one to display it to the user.

+++ b/honeypot.module
@@ -183,12 +193,14 @@ function _honeypot_time_restriction_validate($form, &$form_state) {
+    $form_state['values']['honeypot_time'] = time();

This IMO fixes a bug: the counter would count from the first time the form was created. This change resets the creation time during validation.

+++ b/honeypot.module
@@ -204,6 +216,7 @@ function _honeypot_time_restriction_validate($form, &$form_state) {
+  honeypot_log_failure();

Log the failure of submission.

+++ b/honeypot.module
@@ -213,3 +226,33 @@ function _honeypot_log($form_id, $type) {
+    $number = db_result(db_query("SELECT COUNT(*) FROM {honeypot_user} WHERE uid = %d", $user->uid));

Gets the number of failed submissions of this user.

+++ b/honeypot.module
@@ -213,3 +226,33 @@ function _honeypot_log($form_id, $type) {
+    $number = db_result(db_query("SELECT COUNT(*) FROM {flood} WHERE event = '%s' AND hostname = '%s' AND timestamp > %d", 'honeypot', ip_address(), time() - variable_get('honeypot_expire', 300)));

For anon users we use the flood table and get the events by IP.

+++ b/honeypot.module
@@ -213,3 +226,33 @@ function _honeypot_log($form_id, $type) {
+  return variable_get('honeypot_time_limit', 5) + (int) exp($number);

I am increasing the time needed exponentially. This sounds worse than it really is:

the default cron config will delete events after 5 minutes

the first failure will increase time by 1 second, the 2nd by 7, the 3rd by 20, the 4th by 54. Above that it's your own fault.

+++ b/honeypot.module
@@ -213,3 +226,33 @@ function _honeypot_log($form_id, $type) {
+function honeypot_log_failure() {

Log the events.

without the whitespace issue.

review please

Thanks, this looks good!

I may come up with more improvements as we test drive this on d.o.