All terms
What Is a Honeypot Field? How It Works and How to Add One

What Is a Honeypot Field? How It Works and How to Add One

Published Updated By GoodInbound team

A honeypot field is a form input hidden from people that simple bots fill in, marking the submission as spam. How it works, example code, and its limits.

A honeypot field is an extra input in a web form that real visitors never see and never fill in. Simple spam bots read the form's HTML and fill in every field they find, including the hidden one. When a submission arrives with a value in the honeypot, your server knows a bot sent it and can discard it. Honeypot fields still work against basic bots and cost visitors nothing, but bots that render the page skip them, so use one as a first layer and not the only one.

If you're dealing with form spam at volume, GoodInbound Lead Screen is a drop-in fix with a honeypot already built in. It screens how every visitor fills in your form and stops automated list bombing, spam, and non-buyers sending unsolicited pitches from cluttering your pipeline, with five layers of protection:

  • Rules: domains you always accept or always block.
  • Behavior: how the form was filled in: typing, pasting, fill time, automation tells, and a built-in honeypot.
  • Network: data centers, VPNs, proxies, Tor, and bursts from one IP or device.
  • Identity: whether the email has a working inbox and isn't disposable or gibberish, and whether the phone number is real.
  • Message: the whole submission read for intent, so sales pitches, recruiters, and link offers are caught.

Every submission is classified into five types (lead, review, spam, junk, and bot), and only the real leads, based on your filters, are reported to your CRM and your ad platforms. GoodInbound takes care of the entire flow end to end for you.

Use GoodInbound for free for up to 500 screened submissions a month.

What is a honeypot field?

A honeypot field is a decoy. It looks like a normal text input in the page source, with a believable name, and it is hidden from people with CSS. The name comes from security, where a honeypot is a system set up to attract attackers so they reveal themselves.

In a form, the logic is one rule: if the hidden field has a value, reject the submission. A person can't type into a field they can't see. A bot that fills in everything gives itself away.

How does a honeypot field work?

  1. You add an extra input to the form and hide it with CSS so it takes up no space and can't be reached by keyboard or screen reader.
  2. A person fills in the form. They never see the extra field, so it stays empty.
  3. A simple bot fills in the form. It parses the HTML, finds every input, and puts something in each one, because it can't tell which fields are required.
  4. Your server checks the field. Empty means carry on. Filled means a bot, so the submission is dropped or labeled as spam.

The check has to run on the server. A check that only runs in the browser does nothing against a bot that posts straight to your form's URL without loading the page.

How to add a honeypot field to a form

The HTML

HTML
1<form action="/contact" method="POST">
2 <label for="name">Name</label>
3 <input id="name" name="name" type="text" autocomplete="name" required>
4
5 <label for="email">Email</label>
6 <input id="email" name="email" type="email" autocomplete="email" required>
7
8 <label for="message">Message</label>
9 <textarea id="message" name="message" required></textarea>
10
11 <!-- Honeypot: hidden from people, filled in by simple bots -->
12 <div class="form-extra" aria-hidden="true">
13 <label for="website">Leave this field empty</label>
14 <input id="website" name="website" type="text" tabindex="-1" autocomplete="off">
15 </div>
16
17 <button type="submit">Send</button>
18</form>

The CSS

CSS
1.form-extra {
2 position: absolute;
3 left: -9999px;
4 width: 1px;
5 height: 1px;
6 overflow: hidden;
7}

The server check

JavaScript
1// Any server framework: reject when the hidden field has a value.
2if (typeof body.website === "string" && body.website.trim() !== "") {
3 // Answer as if it worked, so the bot learns nothing.
4 return respondSuccess();
5}

Honeypot field best practices

  • Hide it with CSS, not type="hidden". Bots leave hidden inputs alone, because that is where sites put tokens that must come back unchanged. A type="hidden" honeypot catches nothing.
  • Put the hiding rule in a stylesheet class. An inline style="display:none" is the first thing a slightly smarter bot checks for.
  • Give it a believable name. website, company_url, or fax attract bots. honeypot and trap warn them off.
  • Keep keyboards out with tabindex="-1", so nobody tabs into an invisible field.
  • Keep screen readers out with aria-hidden="true" on the wrapper. A focusable element inside an aria-hidden container is an accessibility error, which tabindex="-1" also fixes.
  • Stop autofill filling it. Set autocomplete="off" and avoid names browsers and password managers recognize, such as email2, phone, or address. If a browser still suggests values, MDN's advice is to change the field's name.
  • Keep a visible label inside the wrapper that says to leave the field empty, for anyone who sees it because the CSS failed to load.
  • Fail quietly. Return the normal success response and drop or label the submission. An error message tells the bot's operator what to fix.
  • Label it, don't delete it. Autofill mistakes happen. Keep trapped submissions somewhere you can review them.

Honeypot field vs. CAPTCHA

Honeypot fieldCAPTCHA
What the visitor doesNothingSolves a puzzle, ticks a box, or is scored in the background
Effect on conversionNoneSome real visitors give up
Stops simple botsYesYes
Stops bots driving a real browserRarelySometimes; challenges can be solved or outsourced
Stops spam typed by peopleNoNo
Third-party script and data sharingNoneUsually

A honeypot is the cheaper first layer. Neither one stops a person pasting a sales pitch into your form. How to stop contact form spam without CAPTCHA shows how the invisible checks stack, and reCAPTCHA alternatives compares the challenge options.

Do honeypot fields still work?

Yes, for the bots they were built for, and those are still most of the volume on a typical contact form. They miss three groups:

  • Bots that render the page. A bot driving a real browser can see which fields are visible and skip the rest.
  • Bots that post only known fields. A script written for your specific form sends exactly the fields it needs and never touches the honeypot.
  • People. Manual spam and sales pitches are typed into the visible fields like any other message.

That is why a honeypot is one layer. Add a time check (reject forms submitted within a couple of seconds of loading), rate limits per IP address, email checks, and screening of what gets through. How to stop contact form spam covers which method stops which kind.

GoodInbound Lead Screen includes the honeypot and adds the rest: how the form was filled in, the network behind it, whether the email and phone are real, and what the message says. To see how a suspicious submission would be judged, paste it into the free form spam checker.

FAQ

What is a honeypot field in a form?

It is an extra input hidden from visitors with CSS. People leave it empty because they can't see it. Simple bots fill it in along with every other field, and the server rejects any submission where it has a value.

Do honeypot fields still work?

They stop basic bots that fill in every field, which is still a large share of form spam. They don't stop bots that drive a real browser, scripts written for one specific form, or people. Use a honeypot with a time check, rate limits, and submission screening.

Why shouldn't I use type="hidden" for a honeypot?

Bots ignore type="hidden" inputs, because sites use them for tokens that must be returned unchanged. A honeypot has to look like a normal text field in the HTML and be hidden with CSS.

Can a honeypot field replace CAPTCHA?

For many small sites, a honeypot plus a time check and rate limits removes enough bot spam that a CAPTCHA isn't needed. It won't stop determined bots on its own, and neither a honeypot nor a CAPTCHA stops spam written by a person.

Can a honeypot block real visitors?

Yes, if a browser or password manager autofills the hidden field. Use a name autofill doesn't recognize, set autocomplete="off", and keep trapped submissions for review instead of deleting them.

What does "please ensure that the honeypot field is left empty" mean?

The form rejected a submission because its hidden honeypot field had a value. For a real visitor that is almost always autofill. Submitting again with autofill turned off usually works, and the site owner should rename the field so browsers stop filling it.

Are honeypot fields bad for accessibility?

Not when built correctly. Hide the wrapper from assistive technology with aria-hidden="true", remove the input from the tab order with tabindex="-1", and include a label telling anyone who does reach it to leave it empty.

Where does the term honeypot come from?

From computer security, where a honeypot is a decoy system left out to attract attackers so they can be detected and studied. A honeypot field applies the same idea to one form input.

Switch in 5 minutes

Setup with your agents