Removed a Signup Page but Bots Can Still Post? Switch Off the Endpoint Too
1What happened
we retired an old chatbot, a quiz and several lead forms on our Next.js site, which is hosted on Vercel. The pages were gone or redirected home. A security check found the code behind them still answering: anyone could still send a lead, a chat or a signup straight to the old addresses, with no page in front. Then a full check found a signup box still showing on two article pages, sending to an address that no longer worked.
2What we did
Switched off every old form address so it returns "not found".
For buildersin Next.js, removing a page does not remove its route handler under app/api. Delete the handler or make it return 404.Kept only what still has a job: the payment webhook, the text-message route a carrier needs, and the unsubscribe link.
Removed the signup box from the shared section that every article page uses.
Changed every button that pointed to a retired page.
Checked every page in the sitemap, not just the pages we touched.
3How we know it worked
a test post to each old form address returns 404. All 17 pages in the sitemap show 0 forms, except the search box on our problem log.
4What you can take from it
when you retire a form, retire the code that receives it, then check every page in your sitemap for leftovers.
