Form spam

Form spam is unwanted, usually automated submission of web forms: bots posting link-stuffed messages, fake signups from disposable email addresses, empty or gibberish payloads, and scripted abuse of any publicly reachable endpoint. Any form on the open web gets it; the only variables are volume and sophistication.

The motives are mundane. Most form spam is advertising - links pushed into any text box that might end up in an inbox, a database, or a published comment. Some probes for vulnerabilities, some tests stolen credit cards against signup flows, and some is simply crawlers submitting every form they find. The senders range from dumb scripts that fill every field (including hidden ones) to headless browsers that execute JavaScript and mimic human pacing.

That range is why no single countermeasure suffices. A honeypot catches the dumb scripts; rate limits cap the floods; content analysis flags link stuffing and throwaway domains; timing signals expose forms submitted faster than a human could read them. Effective spam defense is a stack, and the hardest design question is what to do with the maybes - submissions that look suspicious but might be real.

SheetLink Forms runs exactly such a stack: the _slhp honeypot, per-form and per-IP rate limits, a per-form origin allowlist with CORS, content heuristics (link stuffing, disposable email domains, empty payloads) governed by a loose/normal/strict dial, the sl.js timing signal, and optional Cloudflare Turnstile. Its answer to the maybes is quarantine: suspicious submissions are held for one-click review and delivered on approval - never silently dropped. Only the honeypot marks spam outright.

The stack is documented on the security page, and you can post to a live, defended form on the demo.