Spam, floods and brigading — protecting an open submission form

Short answer. You cannot ask an anonymous submitter to log in, so the aim is to make abuse expensive, not impossible. Rate limits per address and per browser session, a hidden honeypot field, a minimum fill-in time, proof of work, and holding every submission that contains a link stop most of it — and none of them requires knowing who the submitter is.

An anonymous submission form has an unusual security problem. The standard answer to abuse of any online service is to make people identify themselves — sign in, verify an email address, link a phone number. An anonymous page cannot do any of that without ceasing to be what it is. It has to stay open to people it knows nothing about, and still keep its queue readable.

That is achievable. It needs a different set of tools, and it needs an acceptance that the aim is to make abuse expensive, not impossible.

Who abuses a form, and why

The defences depend on the attacker, so it helps to tell them apart.

Automated spam. Programs that crawl the web looking for any form with a text box and fill it with links — to gambling sites, counterfeit goods, loan offers. They are not targeting you in particular. They arrive in bursts, are instantly recognisable, and are the easiest to stop.

Human advertisers. Real people pasting in promotions for their shop, their tuition service or their event. Low in volume and persistent, and they will reword things if rejected.

The single flooder. One person submitting dozens or hundreds of times — sometimes the same message, sometimes variations on it. They may be trying to force a post through by sheer repetition, to bury someone else's submission, or simply to wear the admins down.

Brigades. A group organising elsewhere — a group chat, a rival page — to submit en masse on one subject. This is common around student elections, disputes between societies, and controversies about named people. Each submission comes from a different person and a different device, so it looks like genuine sentiment. That is exactly the intention.

Malicious links. Submissions carrying a link that leads to a phishing page or malware, in the hope that an admin will click on it or, better still, publish it.

Defences that do not require identity

Rate limiting

Limit how many submissions any one source can make within a period of time. It is the single most effective measure, and it is invisible to honest users, who rarely submit more than once or twice in a day.

The difficulty lies in the word "source". The obvious choice is the network address, but addresses are shared. Everyone on a campus Wi-Fi network may appear to come from the same address, and mobile networks routinely place thousands of customers behind one. A limit strict enough to stop a flooder may also block a whole hostel.

There are practical compromises:

• set the limit per address generously — tens per hour, not two;
• add a much tighter limit per browser session, which stops casual repetition;
• when the limit is reached, slow the sender down rather than blocking outright — a wait of a minute discourages a flooder without locking out a neighbour.

Challenges that do not track people

A CAPTCHA proves that a human is present, and it works against bots. Its costs are friction, problems for people who use assistive technology, and — with some providers — the passing of your visitors' data to a third party. That last point sits uneasily with a promise of anonymity.

There are alternatives that require no third party:

• A honeypot field. A form field that is hidden from people but visible to bots, which tend to fill in everything. Any submission with that field completed is discarded. It costs nothing and stops a surprising share of automated spam.
• A minimum time. No person completes a form in under two seconds. Submissions that arrive faster than that are discarded.
• Proof of work. The submitter's browser must solve a small computational puzzle before the form will accept the submission. A person does not notice the half-second it takes. Somebody trying to send ten thousand submissions finds that it costs real computing time. No personal data is involved.

Content rules

• Hold or strip links. Very few genuine confessions contain a URL. Sending every submission that contains a link to a separate review pile — or refusing links altogether — removes most of the motive for spam.
• Catch duplicates. Identical or near-identical text submitted repeatedly can be collapsed into a single item with a count beside it.
• Limit length at both ends. A minimum stops empty and one-word submissions; a maximum stops someone pasting in a novel.

Opening hours

Nothing obliges a form to be open at all times. Some pages close submissions overnight, or once the queue reaches a certain size, and say so plainly. A flood that arrives at three in the morning with nobody watching is far more disruptive than one that meets a notice saying "submissions reopen at 8am".

What not to do

Do not require a login "just for now". The moment you do, the page is no longer anonymous, and genuine submitters — who are the more cautious ones — are the first to leave.

Do not publish the flood. Putting up twenty near-identical submissions to "show what we're dealing with" gives the flooder precisely what they were after.

Do not ban whole networks. Blocking a campus address range, or a mobile carrier, punishes thousands of people for the actions of one.

Do not click links in submissions from the device and account you use to administer the page. If you must check where a link goes, use a link-preview or scanning service, not your browser.

Do not announce your defences in detail. "We limit submissions" is fine. "We allow exactly 15 per hour per address" is an instruction manual.

Recognising a brigade

A brigade is harder to spot than a flood, because every submission is individually plausible. The signs to look for are:

• a sudden rise in volume on a single topic, particularly one that was quiet yesterday;
• similar phrasing, the same unusual word or the same talking point appearing across many submissions;
• arrival in a tight cluster, beginning abruptly;
• submissions that read as though written for an audience rather than to the page — polished, argumentative, slogan-like.

When you see this, the number of submissions tells you nothing about how many people really hold the view. Ten people can send two hundred messages.

A proportionate response is to publish one or two representative posts, if the topic is within your rules at all, and to say openly that many similar submissions were received. Do not let volume buy more space than the subject would otherwise have had. During elections and live disputes, consider a standing rule that the page publishes nothing about candidates or parties to the dispute — and announce it before the campaign begins, so that it cannot be read as taking sides.

During a flood

1. Pause the form if your tool allows, with a brief notice. Ten minutes of closure breaks the momentum of most floods.
2. Do not read every one. Sort by time, find where the burst begins and ends, and deal with it as a block.
3. Look for what it is hiding. Floods are sometimes used to bury one particular submission, or to exhaust admins so that something slips through. Check carefully what arrived just before and during it.
4. Tighten the limits temporarily, then relax them again once it has passed.
5. Record it in your decision log: when, how many, what about. A second attempt usually follows the pattern of the first.

When the abuse is aimed at a person

A flood of submissions about one named individual is not a spam problem. It is harassment, with your page as its intended instrument. Decline all of it, do not publish even a sanitised summary, and consider whether the person ought to be told that they are being targeted. Repeated communication intended to cause someone distress may be a criminal offence — see Doxxing and harassment: the 2025 Penal Code offences.

A realistic goal

You will not reach zero spam, and a form locked down firmly enough to guarantee it would be unusable. Aim for a state in which automated junk never reaches a human, a single determined flooder is slowed to a trickle, and a brigade is recognised for what it is. A handful of well-chosen measures — rate limits, a honeypot, held links and a pause button — will get you there, and none of them requires asking a submitter who they are.

Common questions

How do you stop spam on a form without requiring a login?

Limit how many submissions one source can make in a period, add a hidden honeypot field that only bots fill in, discard anything completed in under two seconds, require a small proof-of-work puzzle from the browser, hold or refuse submissions containing links, and collapse duplicates. None of these identifies the submitter.

What is a honeypot field?

A form field that is hidden from people but visible to bots, which tend to fill in everything. Any submission with that field completed is discarded. It costs nothing and stops a surprising share of automated spam.

Is a CAPTCHA a good idea on an anonymous form?

It works against bots, but it adds friction, causes problems for people who use assistive technology, and with some providers passes your visitors' data to a third party, which sits uneasily with a promise of anonymity. A honeypot field, a minimum time and proof of work need no third party.

How can you tell a brigade from genuine opinion?

Look for a sudden rise in volume on a single topic, the same phrasing or talking point across many submissions, arrival in a tight cluster, and text that reads as written for an audience. Ten people can send two hundred messages, so publish one or two representative posts at most and say that many similar submissions were received.

What should admins do during a flood of submissions?

Pause the form with a brief notice, deal with the burst as a block instead of reading every item, check what arrived just before and during it in case the flood is hiding something, tighten the limits temporarily, and record it in the decision log.

Should a page block a whole network to stop one flooder?

No. Network addresses are shared: everyone on a campus Wi-Fi network may appear to come from one address, and mobile networks place thousands of customers behind one. Blocking a range punishes thousands of people for the actions of one. Slow the sender down instead.