Body
Overview
Online forms and other data-collection tools are useful when the audience is broad or unknown, but they are also easy for automated tools to discover and submit repeatedly. CAPTCHA can reduce simple bot activity, but it does not guarantee that every submission comes from a person or that the information is trustworthy. The controls below reduce abuse while preserving public access when it is genuinely needed.
Choose a tool appropriate for the data
Before creating a form, identify the classification of the information it will collect. The university classifies data according to the harm that could result if it were exposed, changed, lost, or misused.
- Green data is low risk. General-purpose data-collection tools may be appropriate when access and sharing are configured for the intended audience.
- Amber data is moderate risk and requires stronger safeguards. Use only a university-approved service that is appropriate for the information, limit access to people with a legitimate need, and collect only what is necessary.
- Red data is high risk and includes the university’s most sensitive information. Collect it only through a university-approved service specifically authorized and configured for that type of data. Confirm requirements with the responsible data steward or support team before publishing the form.
Authentication and CAPTCHA reduce some risks, but they do not make an otherwise unsuitable tool appropriate for Amber or Red data. Review the Data Classification Quick Reference for definitions and examples, and the Information Asset Classification & Management policy for university requirements.
Require authentication where possible
If a form is intended primarily for university community members or known partners, require users to sign in before submitting. Authentication limits submissions to identifiable accounts, reduces anonymous abuse, and makes follow-up possible when a form is misused. Restricting access to approved users or domains is generally stronger than relying on CAPTCHA alone.
Reduce public exposure
If a form must remain available to unauthenticated users:
- Minimize free-text fields when a structured choice will meet the need. Open text fields are attractive targets for spam links, unwanted content, and oversized submissions.
- Use drop-down lists, required fields, and reasonable validation so submissions follow the expected format. Structured input reduces automated noise and makes unusual responses easier to identify.
- Distribute the form link only as broadly as the audience requires. A link posted publicly may be copied, indexed, or shared with automated services even if the original page receives little traffic.
- When feasible, place the form behind an authenticated university page or portal. This adds a meaningful access boundary while still allowing the intended community to submit information.
Handle submissions cautiously
Controls can reduce unwanted submissions, but they cannot prove that every response is accurate or safe. Treat public form submissions as untrusted until reviewed.
- Do not automatically open links or files submitted through a public form. They may lead to phishing sites or contain unsafe content.
- Validate important information through an appropriate university process before using it to approve access, make payments, change records, or contact individuals.
- Monitor for sudden increases, repeated content, or unusual patterns. Early review can prevent spam from overwhelming notifications, workflows, or downstream data.
Consider platform limitations
A form that must accept anonymous submissions will always carry some risk of spam and misleading content. If repeated abuse disrupts the process, or if the information requires stronger identity assurance or data protection, move the intake to a university-approved platform designed for those requirements. Choose the platform based on the audience, data classification, and consequences of a false or exposed submission.
Get additional support
For help selecting a service, protecting sensitive data, or responding to abuse, contact the support team responsible for the data-collection tool or use the appropriate service listed in the Related Services section on the right side of this page or select Create a Ticket on this page.