Definition
A honeypot is a hidden form field designed to catch automated bots without requiring any user interaction like CAPTCHA. The field is invisible to human visitors — typically hidden with CSS — but visible to bots that scrape and fill in every form field. When a bot fills in the honeypot field, the submission is rejected or silently discarded while appearing successful to the bot.
Honeypots are a frictionless alternative to CAPTCHA services. They require no third-party integrations, no user effort, and no accessibility accommodations. They are highly effective at blocking basic automated spam while letting legitimate users through without interruption.
How Honeypot Fields Work
| Step | Description |
|---|---|
| 1. Hide a field | Add a form field that is hidden with CSS (display: none, position: absolute off-screen, etc.) |
| 2. Label it innocuously | Name it something a bot might expect, like "website", "url", or "comments" |
| 3. Bots fill it in | Automated bots fill in every field they encounter on the form |
| 4. Detect and reject | The server checks if the honeypot field has a value — if so, reject silently |
The key is that the field must be truly invisible to humans. Never hide it with type="hidden" as bots are trained to skip those — use CSS-based hiding instead.
Best Practices
- Combine honeypots with rate limiting for layered spam protection
- Use a field name that sounds legitimate (e.g., "website" rather than "bot_trap")
- Reject silently — do not show an error message to avoid tipping off bots
- Log honeypot triggers to monitor for attack patterns
- Rotate the field name periodically if targeting sophisticated bots
Related Glossary Terms
Frequently Asked Questions
For most use cases, yes. Honeypots require zero user effort, have no accessibility issues, and need no third-party service. CAPTCHA services like reCAPTCHA add friction, page load overhead, and privacy concerns. Honeypots block basic bots effectively; advanced targeted attacks may require additional measures.
Yes. Advanced bots can be programmed to detect CSS-hidden fields and skip them. For high-value forms, pair honeypots with rate limiting, IP reputation checks, and behavioural analysis for comprehensive protection.
No. Properly implemented honeypots use CSS that does not interact with screen readers or keyboard navigation. Unlike CAPTCHA, honeypots present no accessibility barrier.