qa-form-security

Audit a web page by inspecting its DOM elements—forms, inputs, meta tags, and captcha containers—to detect missing CSRF tokens, incorrect autocomplete attributes, and absent or hidden captcha widgets across login, signup, and contact flows.

Detect hidden or absent captcha widgets by inspecting captcha containers in the DOM during a web audit. This flags signup and contact pages that lack captcha protection or catch widgets that exist but are hidden from users.

The correct autocomplete attributes for password fields and other credentials are verified by auditing input fields for proper browser hints. This checks credential, email, name, and phone fields to ensure correct autocomplete behavior for security and user experience.

Form security auditing works on form-less groups that still expose testable inputs or password fields. It requires DOM inspection of these visible inputs and meta tags to detect CSRF, autocomplete, and captcha vulnerabilities.

Verify CSRF token rotation after form submission when auditing state-changing forms to ensure anti-forgery tokens are properly refreshed. This optional interactive verification confirms that tokens actively rotate post-submission to prevent replay attacks.