I will check with our system manager and let you know asap.

Hi Ben,

This is the advice I got:

Use passkeys: You can generate a unique passkey for each user session and embed it in a hidden field in the form. You can then validate the passkey on the server side before processing the form data.

Hidden field detection: You can add a hidden field in theform that is not visible to human users but can be filled by bots. You can then check if the hidden field is empty or not on the server side before processing the form data.

Send email (best solution): You can send a verification code to the user’s email address and ask them to enter it in the web form. You can then verify the code on the server side before processing the form data.

Until one of these option has been established, maybe indeed implement Captcha first, preferably hCaptcha.