一位开发者分享了为静态网站构建安全联系表单的技术方案1。该方案利用Cloudflare Pages Functions（Worker）处理POST请求1，并通过多层防护措施确保表单安全性。其中，reCAPTCHA v3通过行为分析、浏览器指纹和网络信誉等信号生成0.0至1.0的风险评分，阈值设定为0.31。此外，方案还采用了蜜罐字段来捕捉自动机器人，字段名称为"_its-a-trap!"，虽然对用户隐藏，但对机器人可见1。
为了进一步规范数据，表单对各字段设置了长度限制：name字段限制200字符、email字段限制320字符、message字段限制5000字符1。该技术方案最初发布于2026年3月9日，后于3月13日进行了更新1。更新中，作者因隐私考虑，将Google reCAPTCHA v3替换为Cloudflare Turnstile1，并集成Resend用于邮件发送1。整个解决方案结合了客户端和服务器验证、可访问性设计等多层安全措施1。
A developer has shared a technical approach to implementing a spam-resistant contact form on static websites using Cloudflare Workers and verification services.1 The solution initially utilized Google's reCAPTCHA v3, which generates risk scores between 0.0 and 1.0 based on behavioral analysis, browser fingerprinting, and network reputation signals, with the author setting a threshold of 0.3 for form submission.1 However, the author later switched from reCAPTCHA v3 to Cloudflare Turnstile due to privacy concerns, while also integrating Resend for email delivery.1
The implementation incorporates multiple security layers to prevent abuse.1 The form employs a honeypot field named '_its-a-trap!' that remains hidden from legitimate users but is visible to bots, alongside field length restrictions limiting the name to 200 characters, email to 320 characters, and message to 5,000 characters.1 Cloudflare Pages Functions (Workers) handle incoming POST requests on the backend, with both client-side and server-side validation implemented to ensure data integrity.1 Accessibility considerations are also integrated throughout the design.1
The original article was published on March 9, 2026, with an update added on March 13, 2026 introducing the Cloudflare Turnstile alternative.1
评论
还没有评论，欢迎留下第一条。