Do not render contact form if it is requested directly by Spammers

Despite the anti-spam honeypot, I keep getting spam emails bothering me to renew my domain name or buy their "contact us" form spam services.

Legitimate users would access my website first and then go to the **/contact** page to submit the form. How can I display an error page instead of the "contact form" for those spammy clients who are hitting my **/contact** page directly?

I do not want to insert any filtering rules on the frontend webserver, because referrer can be spoofed and Codered sends csrftoken cookie only for form submission. Some commercial proxy servers even remove referrer header in http request.

Is it possible to use a different honeypot field for each client? Such as, different radio and input fields?

Beginne damit, die Seite /contact und ihre Einstiegspunkte für die Verarbeitung des contact-form nachzuverfolgen; im Issue werden keine Quelldateien oder Tests genannt. Ermittle, ob direkte Requests und Honeypot-Felder pro Client unterstützt werden, und lege das erwartete Verhalten vor der Implementierung fest und dokumentiere es.

Vom Indexierungsmodell aus dem Issue-Text verfasst.