Lead forms shrug off junk traffic more cheaply

The lead capture form a vendor embeds on their website sits on a public address by design — the snippet is in their page source, so anyone can read it and post to it. That is fine, and it is meant to be, but until now every submission cost us the same work whether it was a real enquiry or rubbish: the form, the vendor, their products and their services were all looked up before any of the spam checks got a chance to say no.

A rejected submission now costs one lookup instead of four. The form is identified in a single indexed read, the spam checks run, and the rest is looked up only once a submission has got far enough to need it. Nothing about the checks themselves changed — the same tiers in the same order turn away the same things.

A burst from one address is now refused before it reaches the application. A rate rule on the form’s submission address turns away anything past 30 requests a minute from the same place, at the edge of the network. That rule is a setting on our hosting rather than part of this release, so it takes effect when we switch it on; the form works the same either way.

Nothing changes in how a form is set up, what it offers, what happens to a genuine enquiry, or what the recent submissions list shows.

One thing worth knowing if a form has been left switched on after its products were retired: junk sent to a form in that state is now turned away slightly later in the process, so it can leave entries on that vendor’s recent submissions list where previously it left none. Real enquiries to such a form are declined exactly as before — there is nothing left for them to ask for.