06/26/2025
When bots beat your form — but not your brain.
I had a spammer manage to bypass a reCAPTCHA-protected contact form for a client recently.
The form won’t even send without the box checked… yet the message still came through.
Turns out, they didn’t use the form at all. They hit the server directly with a raw POST request, skipping all the browser-side protections.
The IP they used? Already flagged as a known threat.
The problem? The threat detection code was buried too deep. The email was still built and sent before the block kicked in.
So I fixed it — fast. Here’s what I did:
✅ Moved threat detection to the top of the request flow
✅ Blocked submissions without a proper Referrer header
✅ Filtered out bots based on known script-based User-Agents
✅ Replaced redirects with silent 403s — no clues, no noise
No honeypots. No external CAPTCHA validation. No third-party dependencies.
Just fast, invisible, layered defense that stops spam before it starts.
AI helped — but only because I already knew what I was doing.
In the right hands, it's a powerful tool. In the wrong ones, it's just another way to break stuff.
I already knew what I needed to do get done and it went from a few hours to less than 15 minutes to update the existing code.
Tools don’t replace experience — they multiply it.
