Timing trap

A timing trap is a spam signal built from a simple observation: humans take time to fill out forms and bots do not. The page records when the form became available - when it rendered, or when a script loaded - and again when the visitor hit submit. A contact form with three fields takes a person fifteen seconds at minimum; a script that parses the markup and posts a payload does it in tens of milliseconds. A submission that arrives faster than a human could plausibly have read the form is, very likely, not from a human.

The trap is attractive for the same reason a honeypot is: it costs legitimate visitors nothing. There is no challenge to solve and nothing visible on the page; the measurement rides along with the submission as one extra field.

It is also, like every single spam signal, imperfect. Browser autofill lets a real person submit a short form in a second or two, and a patient bot can simply wait before posting. That is why a timing measurement works best as evidence rather than a verdict - a suspiciously fast submission should trigger review, not summary deletion.

The SheetLink Forms embed provides the measurement. When sl.js loads, it starts the clock, and each submission it sends carries a load-to-submit timing signal in the reserved _sl_elapsed_ms field, stored as submission metadata. The signal feeds the spam pipeline as evidence, not a verdict: implausibly fast submissions are routed to quarantine for one-click review, never silently dropped. Only the honeypot marks spam outright.

The layered model the timing signal belongs to is described on the security page, and the reserved field itself is listed in the docs.