Remote profiles are difficult to configure safely, so they're turned off by default on modern CiviCRM installs. However, if I have an old CiviCRM installation, how can I tell if this feature is in use before I turn it off?
It's not 100% but you can identify submissions that are local origin by referer in the web logs.
Additionally, any POST that is not from an external form will have a preceding GET for the same form path, while a POST that is a profile submission from remote origin will not. Good opportunity to practice a little awk 😀