A short guide to form spam

It comes up on almost every project, usually later than it should. Everything we would tell a client about form spam in the time it takes to drink a coffee.

Security is a maintenance habit rather than a purchase, which is why it drifts. Anything you cannot measure here, you are deciding by taste, which is fine as long as everyone knows it.

Why it matters

Honeypots stop most bots without troubling humans. Small and consistent beats large and occasional here. It is worth deciding this deliberately rather than inheriting whatever the last person set up.

How to approach it

CAPTCHAs cost real conversions. This is the sort of thing that compounds, quietly, in both directions. It is worth deciding this deliberately rather than inheriting whatever the last person set up.

Common failure modes

Rate limiting handles the rest. Getting it slightly wrong is survivable. Ignoring it entirely is not. The version that survives contact with a real deadline is the simple one.

What this looks like day to day

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about form spam before you move on:

• Someone can say what the current setup is without going to look
• CAPTCHAs cost real conversions — and you know whether that is true here
• There is a way to tell whether the last change to this helped

None of this needs a rewrite. Most of it is a morning's work once someone decides to do it.