Security

Text captcha, six characters, with decoy input fields whose names rotate every page load. Bots fill the wrong field, trip a honeypot, and never reach the login. The page header prints the onion you should be on, so you can cross-check the address bar against the market's own statement of its address.

See also the security topic. The header-print plus the captcha check are two independent verifications, and running both is the directory's standing advice.