Form spam, explained without the jargon

Every audit we run turns up some version of this. Here is form spam without the vocabulary that usually surrounds it.

Security is a maintenance habit rather than a purchase, which is why it drifts. Doing this properly once is usually cheaper than doing it approximately three times.

The short version

Honeypots stop most bots without troubling humans. Small and consistent beats large and occasional here. Write the reasoning down alongside the decision, because the reasoning is what changes first.

Why people complicate it

Most of the confusion comes from tooling rather than from the idea itself. It is worth being explicit about, because assumptions differ quietly.

CAPTCHAs cost real conversions. Small and consistent beats large and occasional here. Budget a little time for it every quarter and it never becomes a project of its own.

A reasonable first step

Rate limiting handles the rest. None of that requires a large budget, only a decision and someone to own it. It is the sort of thing that looks like polish right up until it costs you an enquiry.

In practice

The cheapest security work is the boring kind done on a schedule. Three things worth confirming about form spam before you move on:

• Someone can say what the current setup is without going to look
• Rate limiting handles the rest — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If any of that sounds like a description of your current setup, it is fixable.