Signup and contact forms for static sites that limit what bots can make you send

This is real output from the kit's own attack simulator (node tools/simulate.mjs), which runs the shipped Worker against scripted abuse. "Emails" are confirmation emails the Worker asked the email provider to send. Difficulty here is 16 bits and the run takes about a minute; the kit's default is 18.

1. Naive bot posts 1,000 random addresses, no proof of work
   attempts  1000   emails sent    0   storage writes     0   expected: 0 emails
2. Form-filling bot fills the hidden honeypot field, 1,000 times
   attempts  1000   emails sent    0   storage writes     0   expected: 0 emails
3. Bot solves the proof of work, one IP, 200 random addresses
   attempts   200   emails sent    5   storage writes    16   expected: at most 5 emails (IP cap)
4. Botnet: 300 IPs each solve the work, 300 random addresses
   attempts   300   emails sent  100   storage writes   301   expected: at most 100 emails (daily cap)
5. Subscription bomb: 300 IPs all target ONE victim address
   attempts   300   emails sent    1   storage writes     4   expected: 1 email
5b. Same bomb, but all 300 requests are fired in parallel
   attempts   300   emails sent    1   storage writes     4   expected: 1 email
6. Replay one solved proof against 200 different addresses
   attempts   200   emails sent    1   storage writes     4   expected: 1 email (the one address the proof was solved for)
7. Same as 6 but the bot posts instantly (before the minimum age)
   attempts   200   emails sent    0   storage writes     0   expected: 0 emails
8. Real visitors: 40 people from 40 IPs subscribe
   attempts    40   emails sent   40   storage writes   121   expected: 40 emails
9. Storage quota used up (storage writes fail), then 50 real visitors
   attempts    50   emails sent    0   storage writes     0   expected: 0 emails, fail closed
10. Mailbox variants: 300 IPs target ONE Gmail inbox as [email protected], v.ictim@, [email protected]
   attempts   300   emails sent    1   storage writes     4   expected: 1 email
11. Contact form: one solved proof reused for 200 different messages from 200 IPs
   attempts   200   emails sent    1   storage writes     5   expected: 1 email to the owner
12. Contact flood that pays the work for every message (200 IPs), then one real signup
   attempts   201   emails sent   31   storage writes   124   expected: at most 30 owner emails (contact cap), and the signup still gets its email
13. One IPv6 /64 (50 addresses in the same network) signs up 50 random addresses
   attempts    50   emails sent    5   storage writes    16   expected: at most 5 emails (IP cap counts the /64)

And the form markup you put on a page (the script adds the hidden field and does the rest):

<form class="shield" data-shield="subscribe" data-endpoint="https://signup-shield.your-name.workers.dev">
  <label for="s-email">Email address</label>
  <input id="s-email" name="email" type="email" autocomplete="email" required>
  <p data-shield-status id="form-status" role="status" aria-live="polite"></p>
  <button type="submit">Subscribe</button>
</form>
<script src="assets/shield.js" defer></script>

Open the live demo to try five of these attacks against a cut-down copy of the Worker running in the page.