signup.too_fast
The form was submitted less than 1.5 seconds after it rendered.
What it looks at#
You measure the time from form render to submit in your own page (a timestamp at load,
subtracted at submit) and send it as fill_time_ms. The check fires when it is under
1,500 ms. The threshold is a judgement, not a measured constant: scripts post in tens of
milliseconds, while a person using autofill and a password manager can still submit within
about a second.
Omit the field when you do not know the time. 0 means “instant” and fires.
Why it matters#
Nobody reads a signup form, types into it and submits it in under a second and a half unless the browser filled it for them. Bots usually do not wait.
What to do#
Medium severity, because fast humans exist: single-field forms and one-click autofill can land under the threshold. Treat it as a reason to challenge, not to refuse outright. Compute the time on the client, and sanity-check it server-side (a client-supplied timestamp can be forged by a bot that knows to do so).