Comment by always_good

Also, if you have a confirmation page on GET, then it must be submitting to a POST endpoint that you could still call directly.