Signs it is time to revisit form spam

This is cheap to get right at the start and expensive to retrofit. A few signals that form spam is due some attention.

The cheapest security work is the boring kind done on a schedule. It is worth deciding this deliberately rather than inheriting whatever the last person set up.

The signals

• Nobody can say when it was last reviewed
• The answer depends on who you ask
• Honeypots stop most bots without troubling humans
• CAPTCHAs cost real conversions

What good looks like

Rate limiting handles the rest. Getting it slightly wrong is survivable. Ignoring it entirely is not. Doing this properly once is usually cheaper than doing it approximately three times.

How to tell if yours is fine

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about form spam before you move on:

• Someone can say what the current setup is without going to look
• CAPTCHAs cost real conversions — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If any of that sounds like a description of your current setup, it is fixable.