Your Forms Are Under Siege: How Web Forms Became the Internet's Favourite Attack Surface

In the pecking order of web application security, forms get surprisingly little respect. Firewalls get hardened, servers get patched, APIs get rate-limited — but the humble contact form, the login page, and the registration flow are often the weakest link in the whole posture.

That oversight is expensive. The FBI's Internet Crime Complaint Center (IC3) logged 859,532 cybercrime complaints in 2024, with reported losses of $16.6 billion — a 33% jump on the year before. A meaningful share of those attacks begin at, or pass straight through, a web form.

859,532 cybercrime complaints in 2024, with $16.6 billion in reported losses — up 33% year-over-year. Source: FBI Internet Crime Complaint Center (IC3), 2024 Annual Report

Forms: The Front Door Attackers Prefer

Web forms are attractive targets for a simple reason: they exist to accept untrusted input. Every field is an open invitation to send data to your server, and attackers take that invitation literally.

The OWASP Top 10 — the reference standard for web application security risks — has ranked injection among its most critical categories for years. In the 2021 edition, injection sits at number three (A03), was tested for in 94% of the applications OWASP assessed, and logged more occurrences than almost any other category. The vast majority of those flaws are reachable through form inputs.

SQL injection: still devastatingly effective

SQL injection has been a known attack vector for more than twenty years, and it remains one of the most common and destructive ways to compromise a web application. Tens of thousands of SQL-injection vulnerabilities have been catalogued in public CVE databases, and new ones land every month.

The mechanics are simple: an attacker submits crafted input through a form field that, if the application does not sanitise it, executes as a database command. The outcomes run from quiet data theft to the wholesale destruction of a database.

Cross-site scripting: the silent infiltrator

Cross-site scripting (XSS) is even more widespread, and it too is overwhelmingly catalogued in the public CVE record. In an XSS attack, a malicious script is injected through a form field and later runs in the browser of anyone who views the stored content.

The 2018 British Airways breach is the textbook example. Attackers slipped malicious JavaScript into the airline's booking flow and skimmed payment details from roughly 380,000 card transactions (the ICO later put the total affected at 429,612 people). The UK regulator initially proposed a £183 million fine and, after representations and the pandemic's impact, settled on £20 million in 2020 — still one of the largest form-related penalties on record.

Phishing: The Form-Based Epidemic

Phishing has grown from crude email scams into slick, form-based credential harvesting. IBM's 2025 Cost of a Data Breach Report found phishing to be the single most common initial attack vector, responsible for 16% of all breaches, at an average cost of $4.8 million per phishing-initiated incident.

Phishing is the #1 initial attack vector at 16% of all data breaches, costing $4.8 million per incident. Source: IBM, 2025 Cost of a Data Breach Report

What makes modern phishing so dangerous is how form-centric it has become. The typical campaign aims at login credentials for cloud services like Microsoft 365, and the flow is always the same: a convincing message points the victim at a page that presents what looks like a legitimate login form. The victim types their credentials; the attacker captures them. These are not clumsy fakes — they are carefully built form experiences designed to be indistinguishable from the real thing.

The knock-on effects are severe. Account takeover has become an everyday event, and the large majority of those incidents trace back to credentials harvested through a fake form.

Credential Stuffing: Your Login Forms Under Constant Assault

If phishing steals credentials one victim at a time, credential stuffing does it wholesale. HUMAN Security reported blocking 26 billion fraudulent login attempts in 2023 alone, and estimates that one in every five visits to a login page is an attempted account takeover.

1 in 5 visits to a login page is an attempted account takeover. Source: HUMAN Security

Older Akamai and Shape Security research put the share of enterprise login traffic coming from credential-stuffing bots as high as 90% on the worst-hit sites. These bots systematically replay username and password pairs stolen in past breaches against your login forms. Because a few percent of those attempts succeed, even a modest volume produces real breaches — and in financial services, account-takeover activity has surged well into the double and triple digits year on year.

The API Layer: Where Form Data Gets Exploited

Modern forms rarely post straight to a server — they talk to APIs. That adds a second attack surface, and it is frequently the softer of the two.

Research from APIsec found that 83% of organisations have critical API vulnerabilities. The details are sobering: 78% of APIs are affected by broken authentication, 89% lack rate limiting, and 97% of API vulnerabilities can be exploited with a single request. When your form submits through an API endpoint, every one of those weaknesses becomes a possible way in.

The Financial Cost of Form-Based Breaches

When form-based attacks land, the numbers hurt. IBM and the Ponemon Institute put the 2025 global average breach cost at $4.44 million. In the United States it hit $10.22 million — an all-time high.

The sector picture is sharper still:

Healthcare is especially exposed. HHS Office for Civil Rights data shows 725 breaches reported in 2023, exposing 133 million records, with the overwhelming majority of US healthcare organisations reporting at least one cyberattack in the past year — many originating from or exploiting web-based forms and portals.

The Vulnerability Exploitation Trend

Verizon's 2025 Data Breach Investigations Report flags a worrying acceleration: exploitation of vulnerabilities rose 34% year on year, credential abuse featured in 22% of breaches as the initial vector, and vulnerability exploitation in another 20%. Third-party involvement in breaches has doubled, to 30% — which frequently means shared form infrastructure and plugins.

Why Traditional Form Security Is Not Enough

Most form security leans on one of three tactics: input validation (sanitising data before it is processed), CAPTCHAs (checking the submitter is human), or rate limiting (throttling high-volume automation).

Each covers a narrow slice of the threat:

• Input validation stops injection attacks but does nothing about spam or abusive content.
• CAPTCHAs slow down unsophisticated bots but are bypassed by 85%-plus of advanced ones, with CAPTCHA farms solving challenges for as little as $0.02 each.
• Rate limiting blunts brute-force attacks but never looks at what a submission actually says.

None of them evaluate the content. A perfectly formatted, syntactically valid submission can still carry spam, hate speech, a phishing URL, or pure junk — and every one of these defences waves it straight through.

The Case for Content-Level Form Moderation

Comprehensive form security needs the layer that traditional tools skip: real-time evaluation of what is being submitted. That means scoring each submission for spam likelihood, flagging abusive language, catching suspicious patterns, and keeping an audit log for compliance — all without adding friction for legitimate users.

With Google's Perspective API set to shut down at the end of December 2026 and CAPTCHAs losing ground to both smarter bots and human abuse, the market is already tilting toward content-aware form protection. The organisations that move early get cleaner data, fewer breaches, and a posture they can actually defend.

Your forms are not a secondary concern. They are a live attack surface, and they deserve the same attention you give your firewall, your API gateway, and your authentication system.

References

FBI IC3. "2024 Internet Crime Report." ic3.gov.

OWASP. "Top 10:2021 — A03:2021 Injection." owasp.org.

ICO / Bird & Bird. British Airways monetary penalty notice, 2020.

IBM & Ponemon Institute. "2025 Cost of a Data Breach Report."

HUMAN Security. "Credential Stuffing and Account Takeover Attacks." 2023.

Akamai / Shape Security. State of the Internet — credential stuffing research.

APIsec. "2024 API Security Market Report."

Verizon. "2025 Data Breach Investigations Report (DBIR)."

HHS Office for Civil Rights. Healthcare breach reporting data, 2023.