When form spam is worth the effort

This is one of those topics that looks small until it costs you something. Form spam is not free, and pretending otherwise leads to bad decisions.

The cheapest security work is the boring kind done on a schedule. It rarely shows up as a line item, which is exactly why it slips.

When it is worth it

Honeypots stop most bots without troubling humans. There is a version of this that is over-engineered, and it is worth avoiding. The practical test is whether someone new to the project could tell, in a minute, that it had been handled.

When it is not

If nothing downstream depends on it and nobody is complaining, it can wait. The cost of getting this wrong is rarely visible on the day it happens.

How to decide

Rate limiting handles the rest. That sounds obvious written down. It is still the thing most often skipped. Anything you cannot measure here, you are deciding by taste, which is fine as long as everyone knows it.

What this looks like day to day

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about form spam before you move on:

• Someone can say what the current setup is without going to look
• Honeypots stop most bots without troubling humans — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Most of the value here comes from doing the first two things, not all of them.