Practical software guides
A public enquiry form must accept a real customer and resist automated abuse. Test those outcomes separately. A low spam count is a poor result if legitimate visitors cannot finish.
| Route | Controls | Legitimate fallback |
|---|---|---|
| Enquiry submission | Server-side validation, length limits, rate limit | Visible failure state; preserve typed input |
| File upload | Allowed types, size limit, private storage, malware handling | Explain accepted formats; approved secure alternative |
| Sign-in recovery | Generic response, rate limit, expiry | Accessible support verification |
| Public search | Bounded query and pagination | Useful empty result; no challenge for ordinary reading |
A browser challenge is only one control. Validate its token on the server, enforce required fields there, and reject oversized requests before expensive processing. Shared networks can put many genuine users behind one address; avoid treating that address as a reliable identity.
A useful test set
- Keyboard-only completion and readable error messages.
- A challenge timeout while text is already entered.
- Two rapid clicks: one submission, no duplicate message.
- Invalid file, oversized body and repeated requests.
- A slow mobile connection and an assisted alternative.
Follow OWASP bot-management guidance. Record blocked abuse, false positives and successful submissions separately. These are proposed tests; they do not certify any public form or prove live enquiry delivery.