If you were a site administrator looking for incoming CSRF attacks, what would you look for?

Normally, you wouldn't know if the incoming request is a CSRF attack or not because in both cases they would look the same except that the CSRF is sent without the user's consent. BUT if your page contains somekind of a "challenge", like a gotcha for instance, then you would be sure that the user himself/herself made the request "knowingly".

So if you were a site administrator, look for critical pages and add a challenge there to protect your users.

I hope you can find this useful for you:

1. http://www.veracode.com/security/csrf
2. http://www.acunetix.com/what-are-csrf-attacks/