FormSentinel: The Complete Guide to Modern Form Protection - Revision history

Dex: /* Introduction — What This Article Is (and Isn’t) */

2026-04-06T07:47:02Z

Introduction — What This Article Is (and Isn’t)

← Older revision		Revision as of 07:47, 6 April 2026
Line 12:		Line 12:
	* ''“I need a better honeypot…”''		* ''“I need a better honeypot…”''
	into:		into:
	* ''“…we ~~accidentally~~ built an enterprise‑grade bot‑defence platform.”''		* ''“…we built an enterprise‑grade bot‑defence platform.”''

	This is the story of how.		This is the story of how.

Dex: /* 15. Optional Behavioural JS Agent */

2026-04-05T17:34:48Z

15. Optional Behavioural JS Agent

← Older revision		Revision as of 17:34, 5 April 2026
Line 270:		Line 270:
	* interaction timing		* interaction timing

	~~Boosts~~ accuracy against automation frameworks.		This boosts accuracy against automation frameworks.

	But JS is '''optional''' — FormSentinel is fully NOSCRIPT functional.		But JS is '''optional''' — FormSentinel is fully NOSCRIPT functional.

Dex: /* 3. Stateless HMAC Tokens — Cryptography Enters the Fight */

2026-04-05T17:30:15Z

3. Stateless HMAC Tokens — Cryptography Enters the Fight

← Older revision		Revision as of 17:30, 5 April 2026
Line 48:		Line 48:

	== 3. Stateless HMAC Tokens — Cryptography Enters the Fight ==		== 3. Stateless HMAC Tokens — Cryptography Enters the Fight ==
	We implemented Stateless CSRF using HMAC by binding timestamp, form UUID, client IP ~~and~~ client User‑Agent which results in the UUID being transformed into a Stateless Nonce.		We implemented Stateless CSRF using HMAC by binding timestamp, form UUID, client IP, client User‑Agent and Request Path, which results in the UUID being transformed into a Stateless Nonce.

	No sessions.		No sessions.

Dex: /* Introduction — What This Article Is (and Isn’t) */

2026-04-05T17:29:14Z

Introduction — What This Article Is (and Isn’t)

← Older revision		Revision as of 17:29, 5 April 2026
Line 5:		Line 5:
	== Introduction — What This Article Is (and Isn’t) ==		== Introduction — What This Article Is (and Isn’t) ==
	This article is '''not''' a technical manual.		This article is '''not''' a technical manual.
	It contains no code ~~and no~~ implementation scaffolding.		It contains no code. No implementation scaffolding.

	Instead, it documents the '''ideas, principles, threats, and insights''' that shaped the multi‑layered system known as '''FormSentinel'''.		Instead, it documents the '''ideas, principles, threats, and insights''' that shaped the multi‑layered system known as '''FormSentinel'''.

Dex at 17:28, 5 April 2026

2026-04-05T17:28:52Z

← Older revision		Revision as of 17:28, 5 April 2026
Line 5:		Line 5:
	== Introduction — What This Article Is (and Isn’t) ==		== Introduction — What This Article Is (and Isn’t) ==
	This article is '''not''' a technical manual.		This article is '''not''' a technical manual.
	It contains no code~~, no PHP,~~ no implementation scaffolding.		It contains no code and no implementation scaffolding.

	Instead, it documents the '''ideas, principles, threats, and insights''' that shaped the multi‑layered system known as '''FormSentinel'''.		Instead, it documents the '''ideas, principles, threats, and insights''' that shaped the multi‑layered system known as '''FormSentinel'''.

Dex at 17:28, 5 April 2026

2026-04-05T17:28:23Z

← Older revision		Revision as of 17:28, 5 April 2026
Line 1:		Line 1:
	''A Journey Through Real‑World Threats, ~~Hard‑Earned~~ Lessons, and the Architecture We Built Along the Way''		''A Journey Through Real‑World Threats, Hard‑learned Lessons, and the Architecture We Built Along the Way''

	__NOTOC__		__NOTOC__

Dex: /* ✅ 22.1. High‑Level Comparison Matrix */

2026-04-05T17:27:21Z

✅ 22.1. High‑Level Comparison Matrix

← Older revision		Revision as of 17:27, 5 April 2026
Line 624:		Line 624:
	{\| class="wikitable sortable"		{\| class="wikitable sortable"
	! Feature / Requirement		! Feature / Requirement
			! Honeypots
	! reCAPTCHA v2		! reCAPTCHA v2
	! reCAPTCHA v3		! reCAPTCHA v3
Line 629:		Line 630:
	! Cloudflare Turnstile		! Cloudflare Turnstile
	! Akismet		! Akismet
	~~! Honeypots~~
	! FormSentinel		! FormSentinel
	\|-		\|-
	\| Requires JavaScript		\| Requires JavaScript
			\| No
	\| Yes		\| Yes
	\| Yes		\| Yes
	\| Yes		\| Yes
	\| Yes		\| Yes
	~~\| No~~
	\| No		\| No
	\| '''No (JS optional)'''		\| '''No (JS optional)'''
	\|-		\|-
	\| Requires Cookies/Sessions		\| Requires Cookies/Sessions
			\| No
	\| Yes		\| Yes
	\| Yes		\| Yes
	\| Yes		\| Yes
	~~\| No~~
	\| No		\| No
	\| No		\| No
Line 651:		Line 651:
	\|-		\|-
	\| Works with NOSCRIPT		\| Works with NOSCRIPT
			\| Yes
	\| No		\| No
	\| No		\| No
	\| No		\| No
	\| No		\| No
	~~\| Yes~~
	\| Yes		\| Yes
	\| '''Yes'''		\| '''Yes'''
	\|-		\|-
	\| Accessibility		\| Accessibility
			\| High
	\| Poor		\| Poor
	\| Medium		\| Medium
	\| Medium		\| Medium
	~~\| High~~
	\| High		\| High
	\| High		\| High
Line 669:		Line 669:
	\|-		\|-
	\| User Interaction Required		\| User Interaction Required
			\| No
	\| Yes		\| Yes
	~~\| No~~
	\| No		\| No
	\| No		\| No
Line 687:		Line 687:
	\|-		\|-
	\| Blocks Template Bots		\| Blocks Template Bots
			\| Weak
	\| Partial		\| Partial
	\| Partial		\| Partial
Line 692:		Line 693:
	\| Partial		\| Partial
	\| Partial		\| Partial
	~~\| Weak~~
	\| '''95–99%'''		\| '''95–99%'''
	\|-		\|-
	\| Blocks Replay Bots		\| Blocks Replay Bots
			\| Weak
	\| Weak		\| Weak
	\| Weak		\| Weak
Line 701:		Line 702:
	\| Weak		\| Weak
	\| Partial		\| Partial
	~~\| Weak~~
	\| '''100%'''		\| '''100%'''
	\|-		\|-
	\| Blocks Headless Browsers		\| Blocks Headless Browsers
			\| Weak
	\| Partial		\| Partial
	\| Partial		\| Partial
Line 710:		Line 711:
	\| Medium		\| Medium
	\| Low		\| Low
	~~\| Weak~~
	\| '''70–90%'''		\| '''70–90%'''
	\|-		\|-
	\| Blocks Browser‑in‑the‑Loop		\| Blocks Browser‑in‑the‑Loop
			\| Weak
	\| Very Weak		\| Very Weak
	\| Weak		\| Weak
Line 719:		Line 720:
	\| Weak‑Med		\| Weak‑Med
	\| Medium		\| Medium
	~~\| Weak~~
	\| '''30–40%'''		\| '''30–40%'''
	\|-		\|-
Line 741:		Line 741:
	\|-		\|-
	\| Requires External Services		\| Requires External Services
	\| ~~High~~		\| No
	\| ~~High~~		\| Yes
	\| ~~High~~		\| Yes
	\| ~~High~~		\| Yes
	\| ~~High~~		\| Yes
	\| ~~None~~		\| Yes
	\| '''~~None~~'''		\| '''No'''
	\|}		\|}

Dex: /* ✅ 21.5. Stability for AT Users */

2026-04-05T17:23:47Z

✅ 21.5. Stability for AT Users

← Older revision		Revision as of 17:23, 5 April 2026
Line 610:		Line 610:
	* no popups		* no popups

	=== ✅ 21.5. Stability for AT Users ===		=== ✅ 21.5. Stability for Assistive Technology Users ===
	FormSentinel:		FormSentinel:
	* does not reorder DOM nodes		* does not reorder DOM nodes

Dex: /* ✅ 20.1. CSRF (Cross‑Site Request Forgery) */

2026-04-05T17:21:21Z

✅ 20.1. CSRF (Cross‑Site Request Forgery)

← Older revision		Revision as of 17:21, 5 April 2026
Line 467:		Line 467:
	* the client IP		* the client IP
	* the client User‑Agent		* the client User‑Agent
	* the exact ~~REQUEST_URI~~ path		* the exact Request path

	'''CSRF attacks become mathematically impossible.'''		'''CSRF attacks become mathematically impossible.'''

Dex: /* ✅ 19.2. Bot Prevalence vs Defence Efficacy Matrix */

2026-04-05T17:18:45Z

✅ 19.2. Bot Prevalence vs Defence Efficacy Matrix

← Older revision		Revision as of 17:18, 5 April 2026
Line 401:		Line 401:
	----		----

	=== ✅ 19.2. Bot Prevalence vs Defence Efficacy Matrix ===		=== ✅ 19.2. Bot Prevalence and Defence Efficacy Matrix ===

	{\| class="wikitable sortable"		{\| class="wikitable sortable"