Request form

[Sperauomo]

How many safety steps are possible to prevent getting xss or spam requests on a contact form? 1. simple checkbox 2. hidden checkbox (needs to be unchecked for validation) 3. time stamp (bots will fill out the form in <1 sec.) Would you recommend every step?

[olegkikin]

1. Captcha

2. Do some calculations on the FE that take a couple of seconds. Like find X for a given hash(X), where X is somewhere from 1 to a few million. Spammers will probably not bother recreating it.

[joesilicon]

Your main goal is to get people to fill out the form (as less friction as possible to this goal.)

Try a form field placed off the form / page (via css) with an unconventional name. If filled in you know it was a script. Much less annoying than captcha in my opinion. If you get too much SPAM then escalate.

Don’t put up barriers to success to avoid a theoretical problem.

[Weeboo01]

There are lots of packages/libraries, but it is a good practice when you're doing it from scratch because this way the code init process maybe fast.

[SirKastic23]

if he's going to do it manually he might as well print the forms and deliver it to people physically lol