--- title: "Stop spam and fake sign-ups ยท Agent Wranglers" url: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/form-spam updated: 2026-10-20 licence: "All rights reserved" --- # Stop spam and fake sign-ups By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20. - Level: Recommended - Chapter: [Abuse and limits](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits) - Rule: Make forms costly for bots and cheap for people. Never let a form send unlimited email to addresses the visitor types in. - How: Add a hidden field that people leave empty, hidden with CSS and skipped by screen readers. Reject forms sent less than 3 seconds after the page loaded. Add a hidden link that robots.txt forbids, and slow down clients that follow it. Confirm email addresses before sending anything else to them. Rate-limit by address and by target email. Use a challenge, such as a CAPTCHA, only after the cheaper signals fail. For forms that send email, see [fixed recipients](https://agentwranglers.se/playbook/email/email-security/fixed-recipients). - Check: Submit the form with the hidden field filled with PENTEST-9c0d, and again within one second of loading. Both are rejected without sending email, and a normal sign-up still works. Example: ```html ``` **For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/form-spam`. - Previous: [Cap the size of every request and answer](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/resource-limits) - Next: [Protect free tiers from automated abuse](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/free-tier-abuse) - [Abuse and limits](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits)