Stopping monitoring submissions reaching your team

$token = getenv('SENRIKO_TOKEN');
$sent = $_SERVER['HTTP_X_SENRIKO_MONITOR'] ?? '';

// Both must be set: an empty token would match every visitor who sends no header.
if (is_string($token) && $token !== '' && $sent !== '' && hash_equals($token, $sent)) {
    // Answer exactly as you would have, and do nothing else.
    header('Location: /thank-you', true, 303);
    exit;
}

import { timingSafeEqual } from 'node:crypto';

function isMonitor(req) {
  const token = Buffer.from(process.env.SENRIKO_TOKEN ?? '');
  const sent = Buffer.from(req.get('x-senriko-monitor') ?? '');
  // Both must be set: an empty token would match every visitor who sends no header.
  if (token.length === 0 || sent.length === 0) return false;
  // Lengths first: timingSafeEqual throws when they differ, which would
  // turn a short header into a 500 for anybody who sends one.
  return sent.length === token.length && timingSafeEqual(sent, token);
}

app.post('/contact', (req, res) => {
  if (isMonitor(req)) return res.redirect(303, '/thank-you');
  // ... your normal handling
});

import hmac, os

def is_monitor(request):
    token = os.environ.get('SENRIKO_TOKEN', '')
    sent = request.headers.get('X-Senriko-Monitor', '')
    # Both must be set: an empty token would match every visitor who sends no header.
    return bool(token) and bool(sent) and hmac.compare_digest(sent, token)

def contact(request):
    if is_monitor(request):
        return redirect('/thank-you')
    # ... your normal handling

def monitor?
  token = ENV.fetch('SENRIKO_TOKEN', '')
  sent = request.headers['X-Senriko-Monitor'].to_s
  # Both must be set: an empty token would match every visitor who sends no header.
  token.present? && sent.present? && ActiveSupport::SecurityUtils.secure_compare(sent, token)
end

def create
  return redirect_to('/thank-you', status: :see_other) if monitor?
  # ... your normal handling
end

// Runs before the form plugin sends anything. The hook name differs by
// plugin: this one is Contact Form 7; WPForms uses wpforms_process.
add_action('wpcf7_before_send_mail', function ($form) {
    $token = getenv('SENRIKO_TOKEN');
    $sent = $_SERVER['HTTP_X_SENRIKO_MONITOR'] ?? '';

    // Both must be set: an empty token would match every visitor who sends no header.
    if (is_string($token) && $token !== '' && $sent !== '' && hash_equals($token, $sent)) {
        $form->skip_mail = true;
    }
});