Starter Web skill
Protect a form from abuse
Protect a public form with layered, accessible controls and measured false-positive handling.
Raise the cost of abusive submissions while keeping legitimate completion safe and observable.
Procedure
- Measure submission volume, abuse patterns, user harm, and current false positives.
- Validate every field and enforce size, frequency, and attachment limits on the server.
- Add low-friction signals such as timing, duplicate detection, and a hidden honeypot.
- Rate-limit by several bounded signals without treating an IP address as a person.
- Apply an accessible challenge only when accumulated risk justifies it.
- Queue or moderate uncertain submissions instead of silently discarding them.
- Give legitimate users a clear retry and support path that does not reveal detection rules.
- Monitor block, challenge, completion, appeal, and false-positive rates by cohort.
- Rehearse provider failure and define whether the form fails open, closed, or into review.
Guardrails
- Do not collect device or behavioral data that is unnecessary for the stated risk.
- Never rely on a client-side control without server-side enforcement.
- Avoid puzzles or interaction patterns that exclude assistive technology users.
--- name: protect-a-form-from-abuse category: web description: Protect a public form with layered, accessible controls and measured false-positive handling. Use when spam or automation threatens submissions without justifying a hostile experience for everyone. --- # protect-a-form-from-abuse Raise the cost of abusive submissions while keeping legitimate completion safe and observable. ## Procedure 1. Measure submission volume, abuse patterns, user harm, and current false positives. 2. Validate every field and enforce size, frequency, and attachment limits on the server. 3. Add low-friction signals such as timing, duplicate detection, and a hidden honeypot. 4. Rate-limit by several bounded signals without treating an IP address as a person. 5. Apply an accessible challenge only when accumulated risk justifies it. 6. Queue or moderate uncertain submissions instead of silently discarding them. 7. Give legitimate users a clear retry and support path that does not reveal detection rules. 8. Monitor block, challenge, completion, appeal, and false-positive rates by cohort. 9. Rehearse provider failure and define whether the form fails open, closed, or into review. ## Guardrails - Do not collect device or behavioral data that is unnecessary for the stated risk. - Never rely on a client-side control without server-side enforcement. - Avoid puzzles or interaction patterns that exclude assistive technology users. ## Done - The layered control plan and data-use rationale are documented - Legitimate, abusive, inaccessible, and provider-failure cases are tested - Block and false-positive metrics are recorded with a verified recovery path