Agent WranglersAbuse and limits Recommended
Stop spam and fake sign-ups
Make forms costly for bots and cheap for people. Never let a form send unlimited email to addresses the visitor types in.
How to do it
Add a hidden field that people leave empty, hidden with CSS and skipped by screen readers. Reject forms sent less than 3 seconds after the page loaded. Add a hidden link that robots.txt forbids, and slow down clients that follow it. Confirm email addresses before sending anything else to them. Rate-limit by address and by target email. Use a challenge, such as a CAPTCHA, only after the cheaper signals fail. For forms that send email, see fixed recipients.
Example
<div class="trap" aria-hidden="true">
<label for="website">Leave this empty</label>
<input id="website" name="website" tabindex="-1" autocomplete="off">
</div>How to check
Submit the form with the hidden field filled with PENTEST-9c0d, and again within one second of loading. Both are rejected without sending email, and a normal sign-up still works.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/form-spam.