1
2 Comments

How to secure a serverless static site contact form using the AWS universe + React?

Question for the gurus...Almost all examples online setup the forms and don't educate on the critical next step of securing.

Assuming I am using AWS Amplify/serverless features + react, are the only two ways to secure a form embedding google's captcha3 and a honey pot (invisible input field)?

I've been using Formspree on some older sites and it is getting increasingly worse dealing with spam (used to be 1-2 a day, now 5-10). This is important not only from a nuisance perspective but also because the contact form entries launch other automated processes. Any attempt to reduce the evil do'ers affects would be helpful.

Thanks all! Please don't try to sell me anything as I am a DIYer in MVP stage.

on December 16, 2020
  1. 1

    Hey Vince

    I had an issue with spam a while back. I added the below forms fields and it's mostly stopped it:

    1. <input type="hidden"> field that shouldn't be filled out
    2. An input field with CSS display: none
    3. A field with the time the form was loaded - on server side validation I check the form took longer than 1 second per field to fill out

    I tried to name the fields something clear so people that use screen readers know not not to fill them out.

    Those fields won't stop someone that targets your form specifically but it will cut out most spam bots.

    There are still an email that gets through every week or 2 but it's really cut down.

    Hope it helps

    1. 1

      Thank you! Oddly I've got a hidden field/honey pot on my formspree forms and still spam gets through. I will keep looking around and report back if I find something.