A decoy on the noticeboard

From empty page to real data.

The leaderboard and noticeboard had existed as empty designs for a while, but only started actually doing something on 19 September. A small PHP/MySQL layer, on the same webspace as the rest of the site, with two endpoints — both with prepared statements, no framework: api/score.php for the leaderboard, api/reactie.php for the noticeboard.

Unlike the leaderboard, the noticeboard got an extra step: every submission first lands in a 'pending' status — invisible to visitors — until someone approves or rejects it via a separate page. No login screen for that, just a long, secret value baked into the link itself, like an unsubscribe link in a newsletter.

The decoy.

To keep bots out without needing an account system or a captcha, the form got a hidden input field called 'website' — invisible to a human, but visible to a script that auto-fills every field in a form. If something does fill in that field, the site quietly pretends it worked: no error message a bot could learn from, just a submission that never shows up anywhere. On top of that, a simple filter: more than two links in one message is an automatic rejection.

No account system here, by the way, isn't a missed step but a deliberate choice — that wouldn't fit a site without tracking and without cookies. Typing a name and a message, without needing to remember a password anywhere, is exactly enough for what a noticeboard needs to do.

A game about ERP consultancy that has to protect its own noticeboard from spam — that feels fitting too.