Getting started with form spam
This is cheap to get right at the start and expensive to retrofit. A short on-ramp to form spam for teams who have not touched it before.
The cheapest security work is the boring kind done on a schedule. Most teams find the first pass takes an afternoon and the maintenance takes minutes a month.
What is actually at stake
Honeypots stop most bots without troubling humans. Small and consistent beats large and occasional here. Check it against what you would want a competitor's site to get wrong.
Your first week
- Find out what is already in place
- CAPTCHAs cost real conversions
- Change one thing and measure it
Rate limiting handles the rest. It is worth being explicit about, because assumptions differ quietly. It rarely shows up as a line item, which is exactly why it slips.
What this looks like day to day
Security is a maintenance habit rather than a purchase, which is why it drifts. Three things worth confirming about form spam before you move on:
- Someone can say what the current setup is without going to look
- CAPTCHAs cost real conversions — and you know whether that is true here
- There is a way to tell whether the last change to this helped
Most of the value here comes from doing the first two things, not all of them.