Question: I've a website where I'm providing email encryption to users and I'm trying to figure out if there's a way to detect **if a user is human or a bot**.
I've been digging into **$\_SESSION** in php but it's easy to bypass, I'm also not interested in **captcha**, **useragent** or **login** solutions, any idea of what I need ?

There are other questions very similar to this one in SO but I couldn't find any straight answer...

Any help will be very welcome, thank you all !

Answer: 
If users will be filling in a form, honeypot fields are simple to implement, and can be reasonably effective, but nothing is perfect. Create one or more hidden fields in the form, and if they contain anything when the form is posted, reject the form. Spambots will usually attempt to fill in everything.

You do need to be aware of accessibility. Hidden fields probably won't be filled in by those using a standard browser (where the field is not visible), but those using screen readers may be presented with the field. Be sure to label it correctly so that these users do not fill it in. Perhaps with something like "Please help us to prevent spam by leaving this field empty". Also, if you do reject the form, be sure to reject it with helpful error messages, just in case it has been filled in by a human.
I suggest getting the Growmap Anti Spambot Wordpress plugin and seeing what code you can borrow from it or just using the same technique. I've found this plugin to be very effective for curtailing automated spam on my WordPress sites and I've started adapting the same technique for my ASP.NET sites.

The only thing it doesn't deal with are human cut-and-paste spammers.