Phil, Adobe originally told us we were alone with this problem, but this now seems not to be the case. You'll need the most recent isapi_redirect.dll from cfinstal@adobe.com which addresses the…

A couple of these entries (top 2 above) were CFHTTP requests, so pressing stop on http.log solved those. The others still appear.

Thanks for the great tips, that IIS filter looks interesting - we are on IIS 8 and will give it a try. Best to nip the problem in the bud before it gets to ColdFusion, that saves coding more and more…

Ah yes, I stand corrected. Definitely missing #'s there too as you say.

I have found that bots overcome hidden fields and don't forget bots can submit to remote pages in isolation, so you should always check for submissions for referrers or IP addresses as  best practice…

Ok, sounds promising. We knew the CF function was ok. Show us the JavaScript and explain what is going wrong. This is why I was asking about the JSON stuff.

Building the table server-side and sending all the HTML to the client, or sending the table data to the client and then building the table, are really the only two ways of approaching this problem,…

Cookie is better since it is very specific to that user. IP's change all the time on some ISPs.

Drop a cookie with a very long expiry date. It's not a 100% solution, as people can erase cookies, and of course use different devices to visit the same websites. That's the nature of the web.

Could it be a loopback check in IIS? Have you tried using the IP of. the server or 127.0.0.1 to get to the CFAdmin instead? What do web logs show as the verb used to access the page?