国内可访问服务替换排查：新增蜜罐反垃圾字段 + CDN 加速域名配置

apps/forms/serializers.py

@@ -5,6 +5,9 @@ class LeadSubmitSerializer(serializers.Serializer):
     form_id = serializers.IntegerField()
     data = serializers.DictField()
     source_url = serializers.URLField(required=False, allow_blank=True, default="")
+    # 蜂蜜陷阱反垃圾注册字段：正常用户不会看到/填写该字段，机器人填写则视为垃圾提交。
+    # 无需接入极验/腾讯云等第三方验证码服务即可降低自动化垃圾提交，详见设计文档 §2.15。
+    website = serializers.CharField(required=False, allow_blank=True, default="")
 
 
 class LeadDeletionRequestSerializer(serializers.Serializer):

apps/forms/tests.py

@@ -80,6 +80,26 @@ def test_lead_submit_requires_form_id():
     assert response.status_code == 400
 
 
+def test_lead_submit_honeypot_filled_silently_rejects_without_creating_lead(
+    contact_form,
+):
+    """蜜罐字段非空视为机器人：返回“成功”假象但不落库、不发通知邮件。"""
+    client = APIClient()
+    response = client.post(
+        "/api/v1/custom/leads/",
+        {
+            "form_id": contact_form.pk,
+            "data": {"name": "张三"},
+            "website": "http://spam.example.com",
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+    assert response.data["success"] is True
+    assert not Lead.objects.exists()
+
+
 # --- PIPL 数据删除权（详见设计文档 §2.15） ---
 
 

apps/forms/views.py

@@ -41,6 +41,13 @@ class LeadSubmitView(APIView):
                 {"error": {"code": "NOT_FOUND", "message": "表单不存在"}}, status=404
             )
 
+        # 蜜罐反垃圾：honeypot 字段非空说明是自动化脚本提交，直接返回“成功”假象，
+        # 不落库、不发通知邮件，避免打草惊蛇（详见设计文档 §2.15 验证码/反垃圾方案）。
+        if serializer.validated_data.get("website"):
+            return Response(
+                {"success": True, "message": form_def.success_message}, status=201
+            )
+
         lead = Lead.objects.create(
             form=form_def,
             data=serializer.validated_data["data"],