I put a WAF on the front door. The spam wasn't using the front door.

There's a small corporate site.

A few days after launch, one piece of spam landed in the contact form.

Zero actual damage. Just a lazy ad.

But there were two real problems.

One: no spam protection at all.