Do not render contact form if it is requested directly by Spammers

Despite the anti-spam honeypot, I keep getting spam emails bothering me to renew my domain name or buy their "contact us" form spam services.

Legitimate users would access my website first and then go to the **/contact** page to submit the form. How can I display an error page instead of the "contact form" for those spammy clients who are hitting my **/contact** page directly?

I do not want to insert any filtering rules on the frontend webserver, because referrer can be spoofed and Codered sends csrftoken cookie only for form submission. Some commercial proxy servers even remove referrer header in http request.

Is it possible to use a different honeypot field for each client? Such as, different radio and input fields?

Comienza rastreando la página /contact y sus puntos de entrada para el procesamiento de contact-form; el issue no menciona archivos fuente ni tests. Determina si se admiten solicitudes directas y campos honeypot por cliente, y define y documenta el comportamiento esperado antes de la implementación.

Escrito por el modelo de indexación a partir del texto del issue.