Protecting forms and pages from bots
The invisible form check, server-side verification, spam scores, crawler verification and rules.
- Lesson
- 4/5
- Reading time
- 7 min
- Sections
- 4
- Through the course
- 80%
Forms without puzzles
Add the script to pages with forms and mark each form (or protect every form). While the visitor fills it in, the browser solves a small proof-of-work challenge in the background and adds a token. Real visitors never see a puzzle.
Verify on your server
Before accepting the form, send the token and your secret to the verify endpoint. Tokens work once and expire after five minutes. The answer includes a bot score from 0 (a person) to 100 (a bot), reasons and an optional spam score. Keep the secret on your server only.
Step by step
- 1Add the scriptOn pages with forms, and mark the forms to protect.
- 2Receive the tokenIt arrives with the form submission.
- 3Verify on your serverSend the token and your secret to the verify endpoint before accepting the form.
- 4Act on the answerUse the bot score, reasons and optional spam score to accept or reject.
Crawlers and rules
- Requests claiming to be a major search engine or AI search crawler are confirmed with reverse and forward lookups; fakes are blocked and logged.
- Rules match country, network, user agent, IP or range, path, crawler status or bot score, and block, challenge, rate-limit or allow. They run top to bottom and the earliest match wins.
Check your understanding
Two rules both match a request: rule 2 blocks, rule 5 allows. Which applies?
Alerts
When failed, blocked, spam or fake-crawler requests in an hour reach at least 50 and three times the usual level, your team is alerted and the bot.attack.detected webhook fires.
Lesson 4 of 5
Protecting forms and pages from bots