Form spam for small teams

The version of this that works is simpler than the version most people imagine. Most advice about form spam assumes a team that does not exist at your size. Here is the version that does not.

Security is a maintenance habit rather than a purchase, which is why it drifts. Assume whoever inherits this will have half your context and none of your patience.

What to keep

Honeypots stop most bots without troubling humans. The reasoning matters more than the rule, because the rule has exceptions. It is worth deciding this deliberately rather than inheriting whatever the last person set up.

What to drop

Process that exists to coordinate ten people is overhead when there are two of you. The reasoning matters more than the rule, because the rule has exceptions.

What good looks like

Rate limiting handles the rest. The cost of getting this wrong is rarely visible on the day it happens. It is the sort of thing that looks like polish right up until it costs you an enquiry.

What this looks like day to day

The cheapest security work is the boring kind done on a schedule. Three things worth confirming about form spam before you move on:

• Someone can say what the current setup is without going to look
• Honeypots stop most bots without troubling humans — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If you are not sure where your systems currently stand on this, it takes us about an hour to find out.