Protect a form from bots
What the platform does by itself when a visitor who has not signed in sends a form, and what is still worth asking the builder for.
Any form open to the public can be hit by scripts: a signup filled a thousand times, a claim button clicked by a bot, a contact box flooded overnight. AppHandle puts a check in front of the anonymous actions itself, so there is nothing for you or the builder to wire up.
You do not add anything
When a visitor who has not signed in sends a form that saves into your app, the platform first asks their browser to do a small amount of work — a fraction of a second, with nothing on screen and no puzzle to solve. A person never notices it. A script that wanted to post a thousand rows has to do that work a thousand times.
The same check applies when an anonymous visitor triggers something that costs you money: running a function, making an external call. You do not configure it, and there is no account, key, or widget to install.
Signed-in people are never asked
The check exists because a caller without an account is not accountable to anyone. Once someone is signed in — you, your editors, or a person your app signed in — the platform does not ask them again.
What it does not do
- It does not stop a determined script. It makes bulk junk expensive, not impossible, and every app also has a limit on how often one visitor can write. A targeted attack is a different problem.
- It does not judge the content. A person, or an AI writing for one, can still send nonsense that passes any check of this kind. Keeping junk out of your records is a matter of reading them.
- It is not a limit per person. "One entry each" is a separate rule you ask the builder for.
- It is not sign-in. Use Add sign-in to know who someone is.
Test it the way a visitor sees it
Your preview is signed in as you, so the check never appears there. Open the published app in a private window and send the form once — that is the path a visitor takes, and the one worth confirming before you call the form finished.
If a form you already published refuses to send with a message about a security check, tell the builder: it means the app was built before this check existed and needs a rebuild, not a new form.