Secure Form Submissions

General-purpose forms — contact, feedback, support requests — are a common target for bots, spam, and abusive submissions. Unlike login or registration, these are usually low-stakes enough that Sentinel Forms can handle the whole thing without you writing a custom verification endpoint.

What you're defending against

• Bot submissions — scripted spam sent straight through the form.
• Abuse via repeated submissions — the same sender flooding the endpoint.
• Malicious content in submissions — spam text, phishing links, or unwanted attachments.

Recommended configuration

1. Enable Adaptive Captcha on the form's Security Group — bots get blocked, real users see no friction.
2. Add a Rate Limiter to cap repeated submission attempts per device/IP.
3. Let Classifier score submitted content for spam and abuse — this is automatic once you're using Forms, and also picks up phishing links via Phishing Detection.
4. Turn on Email Notifications in the form's settings if you want to be alerted as submissions come in, rather than checking the dashboard.
5. Enable Uploads only if the form actually needs file attachments — see Forms for the size limit and required plugin.
6. Use Proxy if you want accepted submissions forwarded straight to your own backend instead of only living in Sentinel.

Integration steps

1. Create a new form under Forms in the Sentinel admin interface.
2. Add the ALTCHA widget inside your HTML form.
3. Point the form's action at Sentinel's submission endpoint (/v1/submit/:slug) — see Forms for the exact markup.

Without a successful ALTCHA verification, the form can't be submitted at all.

Related

• Forms — the feature this use case is built on.
• Login & Auth Protection
• Chat & Forum Moderation
• Classifier