Honeypot
What is a Honeypot?
A honeypot is a decoy that only an automated client will touch. The classic form is a form field hidden from human users with CSS: a person never sees it and leaves it empty, and a script that fills in every input it finds completes it and identifies itself.
It is the cheapest bot detection that exists. No third-party script, no challenge, no cost to the user, and nothing to configure beyond the markup.
The common forms
| Decoy | How it catches automation |
|---|---|
| Hidden form field | Filled in by anything parsing the DOM rather than seeing the page |
| Fake link, excluded in robots.txt | Followed only by crawlers ignoring the exclusion they claim to respect |
| Unlinked URL | Requested only by something guessing or enumerating paths |
| Decoy submit button | Clicked by scripts that select the first matching element |
| Time trap | A form submitted faster than it could be read and filled |
The robots.txt variant deserves a note, because it doubles as a compliance check. A crawler that fetches robots.txt and then requests the path it disallows has told you something more useful than that it is automated — it has told you it does not honour its own stated rules.
Why it is still worth doing
For low-sophistication spam, a hidden field removes a large share of it for a few lines of HTML. No budget, no vendor, no user-facing friction, no accessibility cost if implemented correctly.
The implementation detail that matters: hide the field with CSS, and label it so screen readers skip it. A field hidden with display:none is invisible to a sighted user but may still be announced and focused by assistive technology, which turns the trap into a barrier for exactly the users least able to work around it. Use aria-hidden and tabindex="-1" alongside the visual hiding.
A first filter rather than a defence
A honeypot catches naive automation and nothing else. Any targeted tool reads the computed styles, skips hidden inputs, and avoids disallowed paths — the countermeasure costs an attacker one afternoon, once, and then works against every site using the technique.
So the realistic position is that honeypots are a cheap first filter that reduces noise, not a defence. They stop broad-spectrum form spam; they do nothing against anything aimed at you specifically, where the operator has looked at your markup. For that you need a verdict based on behavioural signals and challenge-response, which do not depend on the attacker being careless.
Put one in your forms anyway. It costs nothing, and a cheap filter in front of an expensive check means the expensive check runs on less traffic.