Why forms are so exposed
Forms exist to lower the effort of getting in touch. Every field removed and every step shortened raises conversion. That same effortlessness is what automation exploits. A form usually has no rate limit, no sender identity and no cost. Its submissions land in an inbox or a CRM that a person reads, often a salesperson whose job is to respond quickly to everything.
What arrives
- Sales pitches disguised as enquiries. Outreach agents use contact forms as an alternative to email because forms bypass spam filters entirely.
- SEO and link spam. Messages containing links, submitted in the hope that someone clicks or that the content gets published.
- Phishing. Links to fake login pages, aimed at whoever reads the submissions.
- Fake leads. Fabricated names and companies that waste sales time and distort pipeline reports.
- Testing. Stolen card details or email addresses tried against forms that trigger confirmations.
Why the usual defences stopped working
Honeypots and timing checks
A hidden field that humans leave empty, or a check that the form wasn't submitted within two seconds, stops simple scripts that post directly to the form endpoint. An agent driving a real browser sees the page as a person does, leaves hidden fields alone and types at human speed.
Image CAPTCHAs
In 2024 researchers at ETH Zurich solved 100% of Google's reCAPTCHA v2 image challenges with a publicly available object detection model, needing about as many attempts as people did. Commercial solving services have sold solutions cheaply for years. Why CAPTCHA is over.
Invisible risk scoring
Modern checks score the browser in the background. They are much better than puzzles and worth using, but they judge whether a session looks automated, not whether anyone intended to contact you. An agent working for a real person, in a real browser, passes.
What a verification wall for forms should do
- Let known contacts through. Existing customers and partners should never meet friction.
- Put a small cost on unknown submitters. A refundable deposit, a proof of human at submit time, or both.
- Refund the ones you wanted. A real enquiry costs the enquirer nothing in the end.
- Serve agents properly. An agent should get machine-readable terms and be able to pay, rather than be blocked or forced to solve puzzles.
This is the design behind Franked for Forms.