Your checkout tells people their input is invalid. It rarely tells them why. That line of microcopy became a legal artifact on 28 June 2025, when the European Accessibility Act…
Table of contents
Something is filling out your contact form at three in the morning, and it is not a person.
HUMAN Security’s 2026 benchmark found 9.22% of agentic activity landing on authentication routes: login screens, sign-up flows, credential prompts. Agents stopped reading pages. They are trying to submit them.
Most forms will refuse. CAPTCHAs, honeypots, timed validation, and multi-step gating were all built on one idea, that a non-human visitor is a hostile one.
That held for twenty years.
It breaks the moment the non-human arrives carrying your customer’s instructions, your customer’s details, and your customer’s card.
The submit button is the new bottleneck
Agents can read your pages. They cannot finish them.
Every control you shipped to stop bots now fires on a paying customer’s delegate. That is the whole problem in one sentence.
On June 3, 2026, Cloudflare CEO Matthew Prince posted Radar data showing automated requests at roughly 57% of HTTP requests to web content against 43% from humans, the first crossover the company has recorded. He had forecast it for late 2027, then revised to early 2027, and conceded it arrived about 18 months early.
Prince’s own caveat is worth keeping: he called the underlying classification “a bit messy,” and the exact crossover date is unclear. Different outlets logged the split anywhere from 57.3% to 57.5%. The direction is not in dispute; the decimal place is.
HUMAN Security’s 2026 State of AI Traffic report, published March 26 and built on more than one quadrillion interactions, put year over year growth in agentic traffic at 7,851%. Automated traffic overall grew 23.5% against 3.1% for human traffic, roughly eight times faster.
Here is the number that should worry anyone who owns a lead form. HUMAN found 69.57% of agentic activity touching product and search routes, while agentic checkout rates sat under 4%.
They arrive. They browse. They stall at the form.
Who should read this
Anyone who owns a conversion point. Growth leads, product owners, and the developer who inherited the contact form three redesigns ago.
If your last audit of that form was a visual one, you have not seen what an agent sees.
What actually changed in the last eighteen months
Crawlers read. Agents act. That distinction was academic in 2024 and is now the difference between a page view and a failed transaction.
Agents stopped scraping and started clicking
Cloudflare Radar splits AI bot traffic three ways: crawlers, assistants, and search, with crawlers still carrying the largest share by a wide margin.
The small category is the one that matters. Agentic traffic sat near 1.7% of automated traffic entering 2025 and grew by four figures through the year, per HUMAN Security.
Chrome’s auto browse capability went live at the operating system level on Android in late June 2026, starting with Pixel 10 and Galaxy S26.
Chrome’s installed base runs into the billions of devices. You do not get to opt out of receiving those sessions.
Same agent, different websites
What the data shows:
The Agent-E research team ran one agent across the WebVoyager task set and reported results per site. Success ranged from 85.7% on Coursera down to 27.3% on Booking, a spread of 58 percentage points from identical software.
Key insights:
- Booking is the outlier at 27.3%, and it is the most form-heavy site in the set (dates, filters, multi-step flows, dynamic validation)
- Content-retrieval sites like Coursera and GitHub cluster at the top, above 80%
- Amazon and Allrecipes land near 70%, so commercial intent alone does not predict failure
Why it matters:
The variable is not agent capability, since the agent is constant across every bar. What changes is the site, which means the failure rate on your forms is something you control rather than something you wait for the labs to fix.
Sources: Agent-E (Emergence AI), arXiv 2407.13032; WebVoyager benchmark
The user agent string stopped telling you anything useful
Atlas and Comet, running in agent mode on a user’s machine, send the same user agent string as ordinary Chrome. There is no server-side token that says “this was an agent.”
Two consequences follow.
- You are almost certainly receiving agent submissions already and counting them as human
- Your bot-detection tooling is guessing from behaviour, and behaviour is exactly where agents look wrong
HUMAN’s data notes that browser-based agents arrive with user agent strings, cookies, and session patterns closely resembling human browsing.
Small volume, unusual quality
Adobe Analytics has reported AI referral traffic converting substantially better than non-AI traffic, a reversal from the year before when it converted worse.
The volume story is less exciting. Cross-industry benchmarks put AI referral at roughly 1% of website traffic, and some measurement firms recorded a decline through Q1 2026.
So the honest framing is not “agents are your biggest channel.” It is that the traffic arriving through agents behaves unlike anything in your existing conversion rate benchmarks by industry, and you cannot currently see it.
How often browser agents actually finish a web task
Web Bench results, 2,454 scored tasks across 452 live websites drawn from the global top 1,000 by traffic.
| Task type | What it involves | Leading agent | Success rate |
|---|---|---|---|
| Read tasks | Pulling information out of live pages | Anthropic Claude computer use | Over 70% |
| Write tasks | Logging in, clearing 2FA, filling forms, downloads | Skyvern 2.0 | 46.6% |
| All tasks combined | Read and write, scored together | Best fully automated agent | 66.0% |
Five of the seven agents tested cleared 70% on read tasks. None cleared half on write tasks. Halluminate names proxies, CAPTCHAs, and authentication blocks as a meaningful share of the failures.
Source: Halluminate and Skyvern, Web Bench, 2025. Skyvern co-authored the benchmark it leads on write tasks, which is worth holding in mind.
The four controls that break first
Every one of these was built on the same assumption. Non-human equals hostile.
That assumption held for twenty years. It stopped holding the moment the non-human visitor was sent by your customer.
| Control | What it tests | Agent outcome |
|---|---|---|
| CAPTCHA | Puzzle-solving under friction | Stall, retry loop, or paid bypass |
| Honeypot | Fills-everything behaviour | Unreliable signal in both directions |
| Dynamic validation | Human timing and mouse events | Submits before validators fire |
| Behavioural gating | Speed and movement patterns | Flagged for being consistent |
Most teams treat WordPress form security as a spam question. It has quietly become a routing question.
CAPTCHA was already a bad trade
Baymard Institute’s quantitative study of 1,027 test subjects found 8.66% of users mistyped their first CAPTCHA attempt, rising to 29.45% once casing errors counted. A further 1.47% abandoned an incentivised survey rather than attempt the CAPTCHA at all, despite having completed 80% of it.
That research covers text CAPTCHAs and dates from 2018, so the specific failure rates do not transfer directly to a Turnstile widget. Baymard’s conclusion has aged better than the numbers: from a usability perspective they never recommend one, because no matter how well implemented, a CAPTCHA leads to some degree of lost sales.
Anyone serious about improving form abandonment rate has known this for years. The agent shift just removes the last excuse.
The solver economy already routes around it
Academic work on CAPTCHA providers and solving services has found automated solvers reaching success rates above 80% against most CAPTCHAs, including hCaptcha, GeeTest, and reCAPTCHA. Purpose-built neural solvers score higher still against text-based challenges.
Commercial solvers now ship as browser extensions that drop straight into agent automation stacks.
The asymmetry is what stings. Determined automation pays cents and passes, while a legitimate delegated agent, working inside a user’s own browser with no solver installed, gives up.
Honeypots stopped being a clean signal
The mechanic rests on one assumption: only a bot fills a field it cannot see.
That assumption was leaking before agents arrived. Netlify’s own documentation and Webflow’s honeypot guide both warn that browser autofill can populate a hidden field named like a real one, which is why implementation advice pushes autocomplete="off" or one-time-code.
An LLM agent reading the DOM does not indiscriminately fill every input the way a spambot does. A vision-based agent never sees the trap at all.
So you get false negatives against agents and false positives against autofill. If you are still deciding what a honeypot is worth in your stack, it is now one weak signal, not a verdict.
Dynamic validation breaks in a specific, boring way
Fields that appear on blur. Error states rendered without ARIA live regions. Submit buttons wired to JavaScript handlers with no native form semantics.
Here is the failure I keep seeing. A required field validates on a debounce, the agent submits before the validator fires, and the page returns a generic error with nothing tied to a field.
The agent has no idea what went wrong. Neither would a screen reader user, which is the tell.
The old rule about client-side vs server-side form input validation holds harder now, not softer.
Where users quit: abandonment rate by form field
What the data shows:
Zuko tracked 1,362 forms over twelve months and isolated the six most common field types. Password fields drive a mean abandonment rate of 10.5%, roughly two and a half times the address field at 4.3%. Email and phone sit in a middle tier at 6.4% and 6.3%.
Key insights:
- The password field is the single worst performer on any form that has one
- Email and phone both cost more than a street address, which is counterintuitive given how much less typing they require
- Zuko notes the median is far below the mean on every field, so a tail of badly built forms is dragging the averages up
Why it matters:
Password and phone are exactly the fields an agent handles well, since it has the data and never mistypes. The friction is human, which means the fields costing you the most conversions today are the ones agent traffic would cost you nothing on.
Sources: Zuko Analytics field benchmarking study
Behavioural gating punishes the wrong trait
Time traps requiring three to ten seconds before submit. Mouse movement scoring. Rate limits. reCAPTCHA v3 risk scores that quietly downweight a session rather than blocking it.
Agents are fast and consistent. Those are the exact two properties these systems were built to treat as suspicious.
Multi-step gating compounds it, since state held in memory across steps is lost the moment an agent reloads. The case that multi-step forms kill conversions was already contested. Add agents and the maintenance burden gets harder to defend.
Form length against completion on a single page
What happens to completion when the same volume of questions is stacked on one screen instead of split across steps.
| Structure | Fields on screen | Completion | Takeaway |
|---|---|---|---|
| Single page, short | 1 to 5 | 89% | Leave it alone. Step navigation costs more than it returns. |
| Single page, long | 16 or more | 8% | The collapse point. Nine in ten starters walk away. |
| Same form, 3 to 4 steps | 16 or more, split | 34% to 71% | Splitting recovers most of the loss. Range depends on field count. |
The counterexample
Local government forms average 71 inputs and take roughly eight and a half minutes, yet hold an 85% view to completion rate. Zuko’s own trend line across its full database, plotting field count against completion, is flat. Length is a symptom. Intent is the variable.
Source: Zuko Analytics benchmarking data. Formstack’s separate research puts multi-page forms at a 13.9% conversion rate against 4.5% for single-page equivalents.
The pattern underneath all four
Every one of these tests for humanness rather than for authorisation.
That was a reasonable proxy when the only non-humans were adversarial. It is now a category error with revenue attached.
Form completion rates by form type
Starter to completion rate: of everyone who begins filling the form, the share who successfully submit it.
| Form type | What it asks for | Starters who finish | vs average |
|---|---|---|---|
| Application | Long personal detail, high intent | 75% | +9 pts |
| Registration | Details traded for account access | 63% | -3 pts |
| Recruitment | CV data, free text, multi-step | 60% | -6 pts |
| Contact and enquiry | Name, email, an open text box | 38% | -28 pts |
Across all form types the average starter to completion rate is 66%. Contact forms are the worst performing type Zuko tracks, and the picture gets worse further up the funnel: only 9% of people who see a contact form end up submitting it, against 45% for forms overall.
Source: Zuko Analytics form benchmarking data. Zuko attributes part of the contact form gap to placement, since these forms often sit at the bottom of information-heavy pages.
Why this is not a bot problem
Calling agent traffic “bot traffic” is the mistake that produces every downstream bad decision.
The agent is the customer, acting under instruction
A delegated agent has a human intent behind it. Often a payment method too.
Blocking it is not blocking spam. It is refusing a lead that already chose you over the alternatives the agent compared.
Shopify has reported sharp growth in orders originating from AI-powered searches, with merchants discoverable inside ChatGPT, Copilot, Google’s AI Mode, and the Gemini app.
The demand exists. The question is whether your form can take it.
Authorisation is replacing detection
Web Bot Auth is the standard doing the replacing. Bots prove identity per request using HTTP Message Signatures (RFC 9421), an Ed25519 key, a Signature-Agent header, and a JWKS directory at /.well-known/http-message-signatures-directory.
Cloudflare folded message signatures into its Verified Bots Program in July 2025. AWS WAF shipped support in November 2025 and now allows verified Web Bot Auth traffic by default.
Cloudflare’s first signed agents cohort covered ChatGPT agent, Goose from Block, Browserbase, and Anchor Browser.
An IETF working group was chartered in 2026. Backers include Cloudflare, Amazon, Akamai, and OpenAI.
What signed identity does not solve
It tells you which agent is calling. It says nothing about who instructed it, or whether that person agreed to anything.
The Signature Agent Card draft carries identity, purpose, expected request rate, and keys. No consent field. No human identity.
Useful for routing. Useless for compliance.
The accessibility dividend nobody planned for
Organisations that treated WCAG as a compliance line item already did most of the agent-readiness work by accident.
The DOJ’s ADA Title II timeline requires public entities serving populations of 50,000 or more to conform to WCAG 2.1 Level AA by April 26, 2027, with smaller entities following in 2028.
Semantic markup, labelled inputs, real submit buttons, server-rendered critical content. The overlap with form accessibility best practices is close to total.
Rough heuristic that keeps proving accurate: if VoiceOver or NVDA struggles with your form, an agent will too.
What breaks downstream, after the form submits
The failures above are visible. These are not, which makes them worse.
Attribution goes dark
A large share of AI-referred traffic arrives without referrer headers and lands in GA4 as direct. Published estimates put it around 70%, though the figure varies by measurement method and none of them are audited.
Google does not separately attribute AI Mode or AI Overview clicks. Both sit inside standard Search Console reporting alongside ordinary search.
You cannot segment what you cannot see, and you cannot argue for a budget you cannot measure.
Consent that nobody actually gave
GDPR Article 7 requires affirmative action. A pre-ticked box does not count.
An agent ticking a marketing consent checkbox on a user’s behalf is not the data subject giving specific, informed, unambiguous consent. Article 5(1)(d)’s accuracy principle has a similar problem when an agent types a phone number pulled from a stale profile.
Nobody has litigated this yet. Anyone building GDPR compliant forms should separate the transactional submit from the marketing opt-in now rather than after a regulator asks.
The practical move is small. Log whether a submission carried a signature, and store it next to the consent timestamp.
Your form becomes an attack surface
OpenAI stated in late 2025 that prompt injection is unlikely to ever be fully solved, and that agent mode in Atlas expands the security threat surface.
A University of Washington study published in July 2026 tested seven agentic browsers, including Atlas, Chrome with Gemini, Claude for Chrome, and Comet. Four allowed attackers to bypass the same-origin policy.
Brave’s team demonstrated indirect injection against Comet using white text on white backgrounds and HTML comments, triggering cross-site actions.
For a form owner that means one thing. If user-generated content renders anywhere near your form, an attacker can leave instructions for the next agent that reads the page.
The standards layer, and why waiting for it is a mistake
There is a real fix coming. It is not ready, and the gap is where the damage happens.
WebMCP, briefly
Patrick Brosset of the Microsoft Edge team proposed WebMCP in August 2025, with Google joining as co-author shortly after. It incubates in the W3C Web Machine Learning Community Group.
Sites register typed tools through a navigator.modelContext API. Agents call them directly instead of guessing at pixels.
The detail that matters most for form owners is the adoption path. The simpler one works by annotating existing HTML form elements, so you do not have to rewrite anything to participate.
Chromium’s Intent to Experiment was filed and approved in May 2026.
Where adoption actually stands
| Standard | Purpose | Status, mid 2026 |
|---|---|---|
| Web Bot Auth | Agent identity per request | Liveon Cloudflare and AWS WAF |
| WebMCP | Sites expose callable tools | Origin trialChrome |
| Signature Agent Card | Key discovery and metadata | DraftIETF |
Google has named Expedia, Booking.com, Shopify, Credit Karma, TurboTax, Redfin, Etsy, Instacart, and Target among early WebMCP experimenters.
Supply is warming and demand has not arrived. Gemini in Chrome is currently the only agent consuming those tools in any volume.
Why the boring fixes beat the exciting ones
Do not commission an agent experience redesign for a standard sitting near zero adoption.
Do fix the things that pay off either way. Every item in the next section improves human completion rates on its own merits, which is what makes it a no-regret move.
If the agentic web arrives slower than its builders hope, you have a faster and more accessible site. If it arrives on schedule, you are ready.
What to change, in order
Ordered by effort against impact. Start at the top.
Audit what an agent actually sees
Render your accessibility tree and compare it to what you see on screen. The gap is usually larger than teams expect.
Then run the real task. Point Claude, ChatGPT, and Gemini at your three highest-value forms and ask each to complete a genuine submission.
Record exactly where each one stops. That log is your backlog.
Lynx and a screen reader work as cheap proxy checks between proper audits.
Fix the structural floor
- Labelled inputs, with
autocompletetokens on the fields that deserve them - Native
<button type="submit">, not a div with a click handler - Server-side rendering of anything required to complete the task
- Errors tied to specific fields, announced in a live region
Nothing here is new. Most of it sits in any competent guide to HTML form best practices written in the last decade.
Generic errors are the single most common agent-stopper I run into. Worth reviewing your form error message examples against the question “could a machine act on this?”
Autocomplete tokens every user-data field should carry
The HTML Living Standard defines a closed vocabulary. WCAG 2.1 Success Criterion 1.3.5 draws on 53 of these tokens. Anything outside the list is ignored.
| Field | Correct token | Seen instead |
|---|---|---|
| First name | given-name |
firstname |
| Last name | family-name |
surname |
email |
||
| Phone | tel |
phone-number |
| Street address | address-line1 |
address |
| City | address-level2 |
city |
| Postcode | postal-code |
zip |
| Verification code | one-time-code |
off |
Two failure modes worth knowing
Invalid tokens fail silently. Write fullname instead of name and the browser ignores it. No warning, no console error, just no autofill.
Chrome, Firefox and Safari deliberately ignore autocomplete="off" on login and address-type fields, a decision documented in Chromium’s own tracker. That is why honeypot guidance points at one-time-code instead.
Sources: WHATWG HTML Living Standard autofill section, W3C WCAG 2.1 SC 1.3.5, MDN. The criterion covers only inputs collecting data about the person filling the form, not a third party. Use the cc-* tokens only if you genuinely mount card fields yourself.
Retire or downgrade the human tests
Replacing a visible CAPTCHA with invisible spam detection reliably lifts completion, and published case studies put the gain in double digits.
In descending order of payoff:
- Move CAPTCHA from always-on to risk-triggered
- Treat a filled honeypot as a signal, not a hard block
- Drop minimum-time thresholds, or raise them past the point where they punish speed
Most of what people want from a challenge is available through CAPTCHA alternatives that never interrupt anyone. Layer them cheapest first, the way any decent approach to form spam prevention already recommends.
One extra reason to move off reCAPTCHA specifically: French regulator CNIL has ruled that it requires prior consent under EU rules, because it sends device data to Google. Which creates a bind worth naming. Gate the script behind consent, and a bot that never consents never gets blocked.
Turn on verification instead of detection
If you sit behind Cloudflare, Akamai, Fastly, or AWS WAF, check whether signed agent verification is available on your plan.
Cloudflare’s verification is live on Free and Pro tiers and expanding. It takes one dashboard toggle.
Then use it. Let verified agents through the controls you keep in place for unverified traffic, rather than applying one blunt policy to both.
Web Bot Auth support across infrastructure platforms
Verification arrives through your edge or firewall, not through your application code. In most cases this is a dashboard check rather than a build.
| Platform | What it does | Live since | Your move |
|---|---|---|---|
| Cloudflare | Signed agents and verified bots, both validated by signature | July 2025 | Enable verified bots, then check the Bot Management and AI Audit views |
| AWS WAF | Allows verified agent traffic by default | Nov 2025 | Confirm your AI category rule is not overriding the default |
| Akamai, Vercel, Shopify | Support reported, though not confirmed in vendor changelogs | Unconfirmed | Ask your account contact directly rather than assuming |
| Everyone else | No verification layer, so agents look like anonymous traffic | Not available | Log the Signature-Agent header yourself |
The distinction that matters for forms
Since July 1, 2026, Cloudflare tracks a metadata field separating direct from intermediary access, meaning who operates the bot. A crawler running on its owner’s schedule is direct. An agent acting on one person’s instruction is intermediary, and that second group is the one filling in your forms.
Merchants on Stripe, Adyen, Nuvei or Worldpay may get agent verification handled processor-side through Visa TAP and Mastercard Agent Pay, which covers checkout but does nothing for your lead forms.
Sources: Cloudflare blog and bot documentation, AWS WAF release note dated November 21, 2025. Web Bot Auth rests on two active IETF drafts, one covering key directories and one covering the signing protocol.
Instrument the difference
Log signature presence per submission. Add a field for it in your CRM.
Segment conversion, lead quality, and downstream revenue by agent-assisted against direct, which usually means fixing how you track form submissions in Google Analytics before anything else.
Server-side submission logs beat client-side pixels here, since a pixel that never fires tells you nothing about a session that completed.
The test is blunt. If you cannot answer “how many of last month’s leads came through an agent,” you cannot make a single other decision on this list with any confidence.
What happens next
Two things are about to happen at different speeds. Agent capability moves fast. Agreement on who is responsible moves slowly.
The gap between those two speeds is where form owners are going to spend the next two years.
The prediction
Gartner’s strategic predictions put 90% of B2B buying as AI agent intermediated by 2028, pushing over $15 trillion of spend through agent exchanges.
Forecasts for the consumer side disagree wildly, and pretending otherwise would be dishonest.
| Source | Scope | Figure |
|---|---|---|
| Gartner | B2B spend by 2028 | Over $15 trillion |
| McKinsey | Global agentic commerce by 2030 | $3 to $5 trillion |
| eMarketer | Agentic commerce by 2029 | $144 billion |
The spread comes from definitions, not from one firm being wrong. “Agent involved somewhere in the journey” and “agent completed the transaction” are different questions, and a forecast that answers the first will always dwarf one that answers the second.
Where the loss will actually appear
Nobody gets an alert saying an agent gave up on their form.
The failure shows up as flat numbers while a competitor’s move, which is the hardest kind of problem to diagnose and the easiest to blame on something else.
Teams already chasing how to increase form conversions will spend a quarter testing button colours before anyone thinks to check whether a machine can reach the button at all.
The mobile parallel, with one difference
Responsive design took roughly a decade to go from optional to assumed. This transition is running in months, not years.
The difference that matters is who complains. Mobile users complained loudly when a site broke. Agents do not complain. They pick the next result.
The uncomfortable part
Adoption is running ahead of trust, and trust is running ahead of law.
Consumer surveys disagree sharply on how far people will delegate. Some large multi-country studies find a majority would trust a personal AI agent to buy on their behalf. Others, asking US adults about everyday purchases, find well under half comfortable with the idea.
Both sets of numbers are real. Framing changes the answer, which tells you the public has not settled its own position yet, and that anyone quoting a single figure at you is selecting for their argument.
Liability already has a partial answer
The federal ESIGN Act states that a contract cannot be denied validity solely because an electronic agent was involved in its formation, so long as the agent’s action is legally attributable to the person to be bound.
Legal analysts have also noted state-level movement, including a California statute foreclosing the argument that an AI system autonomously caused a harm without a responsible party behind it.
Everyone cites the same precedent. British Columbia’s Civil Resolution Tribunal held Air Canada liable in February 2024 for a misrepresentation made by its own customer service chatbot, rejecting the airline’s claim that the bot was a separate legal entity responsible for its own actions.
Consent is the question nobody has answered
Attribution law tells you who is bound. It does not tell you whether a marketing opt-in ticked by software counts as freely given consent.
Gartner expects fragmented AI regulation to cover a large share of the world’s economies within a few years, with substantial associated compliance spending.
Fragmented is the operative word. A submission that is compliant in one market may not be in the next.
What this changes about design work
UX assumed a person with eyes, attention, and patience. None of those assumptions survive contact with a delegated agent.
Good form UX design is still the foundation. It is now the human half of a two-audience problem, and most teams have only ever been briefed on one audience.
The same logic reaches every step behind the form. Anyone running checkout optimization is optimising a flow that increasingly has a machine somewhere in the middle of it.
The question to sit with
An agent fills your form with a slightly wrong phone number. Your team calls it. The person who answers never asked to be contacted.
Whose mistake was that, and which of your systems is supposed to catch it?
Nobody has a clean answer. Start asking anyway, because the submissions are already arriving.
Conclusion
The ordered list above has one flaw. Instrumentation sits at the bottom, and it needs to come first.
You cannot prove any of the other fixes worked if you were not measuring agent-assisted submissions before you made them. Do that part this week, then do the rest.
Here is the constraint nobody puts in the deck.
None of this pays back quickly on agent traffic alone, because agent traffic is still around one percent of sessions. The return arrives on the human side, which is why optimizing your forms for machines is defensible even to a CFO who thinks agentic browsing is hype.
The real blocker is usually organisational.
Ask who owns your highest-value form and you will often get three names, or none. Marketing owns the copy, engineering owns the markup, security owns the challenge, and nobody owns whether the thing actually completes.
Pick one form this week. Not the whole site.
Open an agent, ask it to complete a real submission end to end, and write down the exact point where it stops. That single log tells you more than any framework in this article.
The reframe worth carrying out of here is small and awkward.
Your form’s job was never to confirm the visitor is human. It was to confirm the request is authorised. Those two things stopped being the same thing, and most of the web has not noticed yet.
