[#kYjMyOA](https://0xff.nu/?id=kYjMyOA)  <a href="https://txt.sour.is/external?uri=https://twtxt.net/user/prologic/twtxt.txt&nick=prologic">@prologic<em>@twtxt.net</em></a> <a href="https://txt.sour.is/external?uri=https://twt.nfld.uk/user/jlj/twtxt.txt&nick=jlj">@jlj<em>@twt.nfld.uk</em></a> In a gist: I use a couple of honeypot fields (fake fields that will be filled by bots but not humans). The request goes through a redirector, and if these fields are filled, the signature of the bot is added to the banned list and they can't submit anything. If the honeypot fields have not been filled, the request will be redirected towards the FormSubmit form.