I put a WAF on the front door. The spam wasn't using the front door.

Short summary

A form on a corporate site was receiving spam despite a Cloudflare WAF — because the form submitted directly to an external Backend-as-a-Service API, bypassing the site's domain entirely. The fix requires either adding spam protection at the BaaS layer or routing submissions through your own verification endpoint first. The lesson: before deploying security tools, check where the request actually goes in the Network tab.

• •WAF on your domain won't stop spam that submits directly to an external BaaS API
• •Fix by adding honeypots/time-traps at the form or routing through your own verification endpoint
• •Always check the Network tab first to see where form submissions actually go

Generated with AI, which can make mistakes.