# Public form verification record

Guide: https://noobquestions.com/server-side-turnstile-validation-checklist/
Version: 2026-10-02. Blank worksheet; not evidence of a completed test.

System / version (keep identifiers private):
Operator and date:
Expected hostname / widget action:
Test environment / approval:

| Check | Expected observation | Observed result | Pass / fail |
| --- | --- | --- | --- |
| Fresh valid token | One action, clear confirmation | | |
| Token missing or oversized | No side effect | | |
| Invalid / reused token | Rejected; fresh challenge offered | | |
| Wrong hostname or action | Rejected | | |
| Siteverify timeout / bad response | Temporary failure; no side effect | | |
| Duplicate submission after valid challenge | Application idempotency prevents duplication | | |
| Malicious markup | Stored/displayed safely or rejected | | |
| Burst of requests | Rate limit activates | | |
| Browser error path | Entered text retained; secret not exposed | | |

Issues found / remedial actions:
Retest date and result:
Do not include tokens, secrets, IP addresses, or confidential submissions in public reports.