A practical checklist for form spam

The advice here is unglamorous, which is probably why it gets skipped. Run through this the next time form spam comes up.

The cheapest security work is the boring kind done on a schedule. The practical test is whether someone new to the project could tell, in a minute, that it had been handled.

The checklist

• Honeypots stop most bots without troubling humans
• CAPTCHAs cost real conversions
• Rate limiting handles the rest
• Someone is named as the owner
• There is a date to review it again

What it costs to ignore

Honeypots stop most bots without troubling humans. This is the sort of thing that compounds, quietly, in both directions. The practical test is whether someone new to the project could tell, in a minute, that it had been handled.

The short version

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about form spam before you move on:

• Someone can say what the current setup is without going to look
• Rate limiting handles the rest — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Worth checking on your own setup before it becomes someone else's problem to fix.