Time-traps and submit-delay heuristics

The form carries a signed timestamp from render. On submit, the server compares it to now. Under a threshold — two seconds, five, whatever you picked — the submission is treated as automated and discarded.

Some implementations add an upper bound as well, on the theory that a form sitting open for an hour is a stale or replayed session. That second rule is where the damage is.

Single-shot scripts that fetch the page and POST in the same breath, and replay attacks that reuse a captured payload. Both are common, both are cheap to run, and both disappear under a lower bound of a few seconds.

It is the second-best zero-friction defense after a honeypot, and for the same reason: the real visitor never knows it exists.

await sleep(9000). That is the entire bypass, and it is one line in any automation framework.

The cost to the attacker is throughput, not capability — and throughput has not been the constraint for a long time. Someone submitting 665 forms in seventy-six minutes is running roughly one every seven seconds; a nine-second delay per worker and four workers in parallel puts them back where they started, on a laptop.

The upper bound fails in a more expensive way. Consider who takes twenty minutes on your quote form: someone who opened it in a tab, went to find last year’s invoice, checked a number with a colleague, came back and finished. That is not a stale session. That is the most qualified person who touched your form today, and an expiry rule rejects them with a message they will read as “this site is broken.”

People treat forms as a task to prepare for. Timing rules assume they treat them as a reflex.

Keep a lower bound of two or three seconds. It is free and it removes the crudest traffic. Drop the upper bound entirely, or set it in hours and log what it catches before you trust it.

Then do the thing almost nobody does: store the timing rather than only enforcing it. Time-to-submit, and ideally time-per-field, is a genuinely rich signal and it is sitting there for free.

• Per-field dwell time is a drop-off analysis you did not have to instrument separately — the field people stall on is visible before anyone abandons.
• The distribution is bimodal when you are being hit, and the shape of it tells you whether you are looking at automation or at a click farm.
• Once submissions carry a verdict, you can check whether the fast ones close. Our guess is that they do not, and that is checkable rather than assertable.