Concept: Behavioral Anti-Bot Checks with JS-Generated Tokens
Why?

    Bots and scripts often submit forms immediately without any user interaction.
    Humans almost always perform some interactions on the page: moving mouse, scrolling, typing, clicking.
    Capturing these user events and generating a token or flag lets your server validate whether the form submission likely came from a real user or a bot.

How does it work?

    At page load:
        JavaScript binds listeners for user interactions — scroll, mousemove, keydown, click.
        Upon the first such interaction, JS injects or enables a hidden input field with a token or sets a flag value in a hidden field.

    Timing enforcement:
        Additionally, measure time elapsed since the page was loaded.
        Detect if a form was submitted too quickly (e.g., within 2 seconds), flag as suspicious.

    On form submit:
        The token or interaction flag is sent with the POST data.
        The server validates:
            Is the token present?
            Was the token generated properly (optionally signed, timestamped)?
            Has enough time passed before submission?

    If validation fails:
        Reject the submission or treat as bot.
        Log, throttle, or challenge user further (captcha, etc.).

Implementation details
JavaScript snippet: generate interaction token

document.addEventListener("DOMContentLoaded", function() {
    let interactionDetected = false;

    function markInteraction() {
        if (interactionDetected) return;
        interactionDetected = true;

        // Create hidden input if not exists
        let form = document.querySelector('form');
        if (!form) return;

        let input = document.getElementById('user_interaction_token');
        if (!input) {
            input = document.createElement('input');
            input.type = 'hidden';
            input.name = 'user_interaction_token';
            input.id = 'user_interaction_token';
            // Simple token: timestamp or randomized string, can be enhanced e.g. signed/tokenized
            input.value = Date.now();
            form.appendChild(input);
        }
    }

    // Bind common interaction events
    ['scroll', 'mousemove', 'keydown', 'click'].forEach(eventType => {
        window.addEventListener(eventType, markInteraction, { once: true });
    });
});

Include this JS code on your form page (directly or via asset bundle).
Server-side validation (PHP)

In your controller action processing the form:

use Yii;

// Minimum time (e.g. 2 seconds) users must interact before submitting
define('MIN_FORM_TIME_MS', 2000);

$post = Yii::$app->request->post();

$userInteractionToken = $post['user_interaction_token'] ?? null;

if ($userInteractionToken === null) {
    // No interaction token submitted - possible bot
    Yii::$app->session->setFlash('error', 'Suspicious activity detected: no user interaction.');
    return $this->refresh();
}

// Check time elapsed since token was created (assumes token is timestamp)
$now = round(microtime(true) * 1000);
$elapsedTime = $now - (int)$userInteractionToken;

if ($elapsedTime < MIN_FORM_TIME_MS) {
    // Submitted too quickly - likely bot
    Yii::$app->session->setFlash('error', 'Suspicious activity detected: form submitted too fast.');
    return $this->refresh();
}

// Proceed with normal validation and processing

Enhancements for stronger security

    Use a signed token with embedded timestamp instead of plain timestamp to avoid token tampering.

    Track multiple events or rebuild interaction token if needed.

    Use cookies or Web Storage for additional behavioral signals.

    Implement progressive delays or challenges on suspicious submissions.

Benefits

    Very low friction for legitimate users (token generated automatically on first interaction).

    Bots that don’t simulate user events or submit immediately get blocked.

    Can be combined with other techniques (honeypots, captchas, rate limits).

Summary

This approach lets you:

    Track real user interactions client-side with minimal JS.

    Require minimum time spent and interaction before submission server-side.

    Reject or challenge suspicious fast/no-interaction submissions.

If you want, I can help you integrate this into your existing Yii2 forms with code examples, asset bundles, and demo!

help make this code better, more complete and how i intergrate it