Forms that failed now and then, fixed at the cause

A small Australian disability-support provider brings people to its site through Facebook ads. Its contact and referral forms failed now and then, on some devices and not on others. Every failed form was someone who wanted help and couldn’t get through.

Before the contract even started, I looked at the site from outside and saw the pages coming from the cache. That meant the form carried a security token that was stale or already used. Once I had access, through a separate admin account they could remove later, I wrote a script to measure it. I loaded the referral page five times and got the same token every time. A second script walked the sitemap for every page with a form and found the same problem on the contact page.

I excluded just those two pages from the cache and cleared it, then sent each form several times in Chrome, Safari and a phone emulator. Making the cache expire together with the token would only move the failure to another moment, so I didn’t go that way.

The owner tested the forms every day for a week and closed the contract with a 5.0 rating. After that I reviewed the rest of the site and ranked the plugin updates by risk, each with a backup, a test copy and a way back.