Add bot resistance to my public forms: signup, contact, comments, and any other unauthenticated form that writes to the database or sends email. Layer the defenses from least to most intrusive and stop when each form is adequately protected: a honeypot field (hidden from humans, filled by bots) that silently rejects submissions; a minimum time-to-submit check (a form completed in 200ms is a script); rate limiting per IP on submissions; and email verification gating anything public-facing (unverified accounts' content never displays). Reserve a visible CAPTCHA for forms that are actively under attack, since it costs real users friction. Never trust client-side-only checks; every defense must be enforced server-side. Do not add friction for logged-in users performing normal actions. Do not silently drop honeypot submissions with an error; accept them politely and discard, so bots can't tell they failed. Show me each form and its protection. Give me a test for each: submit with the honeypot filled, submit instantly after page load, and submit repeatedly, confirming each is handled while a normal submission still succeeds.