Public forms attract automated submissions, but an aggressive challenge can also prevent real people from getting help. Use layered controls that are proportionate to the form's risk.
Protect the endpoint and the visitor
- Validate length, format, and allowed fields on the server.
- Limit repeated submissions while allowing shared networks and legitimate retries.
- Use a privacy-conscious challenge only when less intrusive controls are not enough.
Never trust browser-only validation as protection. Monitor false positives and provide an alternate contact route if the form's protection blocks a legitimate submission.