How a formexposed check works: passive, transparent, respectful

When you enter a domain in the free check on formexposed.com, a scanner visits that website and comes back with a report. This post walks through what happens in between: what the scanner loads, what it looks at, what it deliberately does not do, and why some details only appear once you have shown that the domain is yours.

From domain to report

The scanner loads the public pages of the site the way a browser would, including the scripts that run on them. That matters because many forms, CAPTCHA widgets, cookie banners and tracking tags are only added by JavaScript after the page has loaded; a look at the raw HTML alone would miss them. On those pages the scanner looks for forms and sorts each one by purpose – contact form, newsletter sign-up, login and so on. The classification puts the findings in context: a newsletter box has different needs than a contact form that delivers messages straight to someone’s inbox.

What the scanner looks at

• Spam and abuse protection: whether there is a CAPTCHA (reCAPTCHA, hCaptcha, Turnstile, Friendly Captcha, a custom math or image captcha, or a server-side anti-spam service) and whether it is set up effectively – a public test site key or a widget without its script protects nothing. Also honeypot fields, CSRF tokens and time traps.
• The surroundings: known-vulnerable CMS and plugin combinations, whether the form posts to a third-party service, and whether a WAF or CDN sits in front of the site.
• GDPR signals: a link to the privacy policy at the form, whether declining the cookie banner really stops tracking, ad or tracking pixels firing on form pages, session-replay tools that may record what people type, and a recipient e-mail address visible in the page source.
• Accessibility signals: axe-core checks on the form (labels, error messages, contrast and more), whether the CAPTCHA is accessible, honeypots that screen readers announce, and how the form works on a phone – tap targets, overlays covering the submit button, horizontal scrolling.

Passive, transparent, respectful

The anonymous check is passive. The scanner reads pages; it does not fill in fields, does not submit a single form and does not try to log in anywhere. Nobody receives a test message, and nothing ends up in the site’s inbox or database. It also behaves like a well-mannered visitor: it reads robots.txt and respects it, and it identifies itself as FormExposedBot instead of pretending to be an ordinary browser. Anyone who finds that name in their server logs can look it up at formexposed.com/bot, which explains what the bot does.

Protected, partially protected, exposed

• Protected: the forms found have protection that appears to be effective, with no notable gaps visible from the outside.
• Partially protected: protection is there, but with gaps – for example a CAPTCHA running with a test key, or one form protected and another not.
• Exposed: forms lack detectable protection or show weaknesses that make abuse easy.

The level summarises what can be seen from the outside; it is not a guarantee in either direction. Reports from anonymous checks are short-lived on purpose and are not indexed by search engines. And because anyone can enter any domain, they leave out vulnerability details: the report shows that something needs attention, but not the exact weak spot an attacker could use. Those details are shown only to verified owners of the domain.

What changes with a verified domain

Two of these deserve a closer look. Active checks are off unless you switch them on, and they are only available for a domain you have verified. The scanner then sends a few clearly marked test submissions, so you and your team can recognise them. Together with the delivery check, this answers a question no passive scan can: does a message sent through the form actually arrive? Monitoring, on the other hand, is built to stay quiet. You get an alert – by e-mail, webhook, Slack, Discord, Telegram or Google Chat – only when something changes, for example when a CAPTCHA disappears after an update or a new tracking pixel shows up on the contact page.

If you want to see what the scanner sees, start with the free check on formexposed.com: enter your domain and read the report. If the site is yours and you want the details, regular monitoring and the delivery check, verify the domain in an account.