What it is
A form with action and method posts to a URL. A form with neither is a collection of inputs that only means something once your JavaScript has attached to it.
Captcha adds a second gate, deliberately designed to be impassable to automation.
Why an agent cares
Browser agents that fill in forms for a user already exist, and a form that only works while your JavaScript is running is the kind they are most likely to fail on.
The trade-off here is genuine: the same properties that let a buyer's agent submit an enquiry let a spam bot submit a thousand. The answer isn't to remove the captcha — it's to keep one un-gated path that is cheap for you to filter.
How to fix it
- Give important forms a real
actionandmethodso they degrade without JS. - Keep an un-captcha'd alternative — a published email address, or a documented endpoint.
- Prefer scoring and rate-limiting over hard challenges on low-risk forms.
How we test it
We parse every <form> for an action target and input count, and scan for reCAPTCHA, hCaptcha and Turnstile markers.