# Contact Form Spam Protection

## Implemented Anti-Spam Measures

### 1. CAPTCHA Verification
- Uses django-simple-captcha
- Visual challenge-response test
- Prevents automated bot submissions

### 2. Honeypot Field
- Hidden "website" field invisible to users
- Bots typically auto-fill all fields
- Submission rejected if honeypot is filled

### 3. Time-Based Validation
- Uses a server-signed form load token
- Rejects submissions completed in less than 3 seconds
- Rejects forged, modified, or expired tokens
- Prevents automated rapid-fire submissions

### 4. Rate Limiting (IP-based)
- Maximum 3 submissions per IP address or email within 15 minutes
- Maximum 10 submissions per IP address within 24 hours
- Prevents spam floods from single source
- IP address stored with each enquiry

### 5. Duplicate Detection
- Checks identical subject/message combinations by email or IP address
- Blocks duplicates within 24-hour window
- Prevents accidental or intentional resubmissions

### 6. Content Validation
- Rejects excessive links in names, subjects, and messages
- Rejects malformed phone numbers and repeated-character payloads
- Requires a meaningful minimum message length

## Technical Implementation

### Model Changes
- Added `ip_address` field to ContactEnquiry model
- Tracks submission source for rate limiting

### Form Enhancements
- Added `form_loaded_at` hidden timestamp field
- Validates submission timing
- Enhanced honeypot validation

### View Logic
- IP address extraction from request headers
- Rate limit checking before save
- Duplicate content detection
- Proper error messaging to users

### Frontend
- JavaScript sets form load timestamp on page load
- Hidden fields remain invisible to users
- Maintains user-friendly experience

## Configuration

### Adjustable Parameters

**Rate Limiting:**
```python
# In settings.py
CONTACT_RATE_LIMIT_MINUTES = 15
CONTACT_RATE_LIMIT_COUNT = 3
CONTACT_DAILY_LIMIT_COUNT = 10
```

**Time Validation:**
```python
# In settings.py
CONTACT_FORM_MIN_FILL_SECONDS = 3
CONTACT_FORM_TOKEN_MAX_AGE = 7200
```

**Duplicate Detection:**
```python
# In views.py
last_24h = timezone.now() - timedelta(hours=24)  # Duplicate check window
```

## User Experience

- Legitimate users unaffected by spam protection
- Clear error messages for rate limiting
- CAPTCHA provides visual feedback
- Form maintains fast, responsive feel

## Admin Benefits

- IP addresses logged for spam analysis
- Reduced spam in admin enquiry list
- Better quality leads
- Less time spent filtering spam

## Migration Applied

```bash
python manage.py makemigrations site_config
python manage.py migrate
```

Migration file: `site_config/migrations/0007_contactenquiry_ip_address.py`