fix: pricing paths, contact form spam guard, tracker on all pages, drop unused CDN script (cockpit #163 #164 #171)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-23 06:45:34 +10:00
parent 9e6a41fc5d
commit 3ea2be5a43
17 changed files with 72 additions and 53 deletions
@@ -35,6 +35,16 @@ if (!$data) {
    $data = $_POST;
 }

+// Spam check (cockpit #164). Bots fill the hidden hp_trap field or post straight to this
+// handler without the fill time the page script adds, or submit faster than a person can type.
+// Answer ok so the bot learns nothing, send nothing, and leave one log line to measure with.
+$fillMs = $data['fill_ms'] ?? null;
+if (!empty($data['hp_trap']) || !is_numeric($fillMs) || (float)$fillMs < 3000) {
+    error_log('HELP4BIS contact form: spam dropped (' . (!empty($data['hp_trap']) ? 'honeypot' : (!is_numeric($fillMs) ? 'no fill time' : 'too fast')) . ')');
+    echo json_encode(['ok' => true]);
+    exit;
+}
+
 // Sanitise and validate required fields
 $name     = trim(strip_tags($data['name']     ?? ''));
 $email    = trim(strip_tags($data['email']    ?? ''));