Web to Lead Forms security

Or Web to Lead forms is simply something obsolete which is going to be rolled out?

Are you talking about on premise? Or a cloud release? Either way you should check the advanced configuration section of the admin guide. Maybe, I haven't tested it yet, you can utilize the http_referer setting in the config. And if it's on premise you could always configure the server itself to allow only connections from a few ip addresses / domains

Thanks, It's on SugarCloud

then I think it's best to create a support ticket with this question. When you have an answer let us know ;)

Another "useful" link: https://support.sugarcrm.com/Knowledge_Base/Campaigns_Target_Lists/Preventing_Web-to-Lead_Spam_Entries/

I will post a case as Jeroen suggests...

I believe the following method is what you are looking for?
sugarclub.sugarcrm.com/.../restful-web2lead-form

Yes, this blog post is already 6 years old but it still describes how to hide your CRM server address from being used for hacker attacks.

Thanks to everybody for their answers, very good info.

I posted a case in Sugar Portal and got this answer which clarified my doubts:

The Sugar API of a public instance, is open to anyone to make requests as long as they are able to authenticate.

There are a couple of core API calls that do not require authentication.

One of those is the Web2Lead form that allows users to create Leads. That endpoint can create only Leads but it cannot retrieve Leads.
When creating Leads, it sanitizes the user inputs to avoid any hacking attempts.

The only known issue is that bots could fill the Web2Lead forms from a website and generate many false Leads but this can be solved by implementing a Captcha as per the articles that you provided.