Honeypot
A honeypot is a decoy — hidden form fields, fake endpoints or trap pages that humans never touch, but bots and scrapers do, exposing themselves in the process.
Advanced Bot Trapping
Deploy intelligent honeypots with bot protection
What is a Honeypot?
A honeypot is a decoy that only an automated client will touch. The classic form is a form field hidden from human users with CSS: a person never sees it and leaves it empty, and a script that fills in every input it finds completes it and identifies itself.
It is the cheapest bot detection that exists. No third-party script, no challenge, no cost to the user, and nothing to configure beyond the markup.
The common forms
| Decoy | How it catches automation |
|---|---|
| Hidden form field | Filled in by anything parsing the DOM rather than seeing the page |
| Fake link, excluded in robots.txt | Followed only by crawlers ignoring the exclusion they claim to respect |
| Unlinked URL | Requested only by something guessing or enumerating paths |
| Decoy submit button | Clicked by scripts that select the first matching element |
| Time trap | A form submitted faster than it could be read and filled |
The robots.txt variant deserves a note, because it doubles as a compliance check. A crawler that fetches robots.txt and then requests the path it disallows has told you something more useful than that it is automated — it has told you it does not honour its own stated rules.
Why it is still worth doing
For low-sophistication spam, a hidden field removes a large share of it for a few lines of HTML. No budget, no vendor, no user-facing friction, no accessibility cost if implemented correctly.
The implementation detail that matters: hide the field with CSS, and label it so screen readers skip it. A field hidden with display:none is invisible to a sighted user but may still be announced and focused by assistive technology, which turns the trap into a barrier for exactly the users least able to work around it. Use aria-hidden and tabindex="-1" alongside the visual hiding.
A first filter rather than a defence
A honeypot catches naive automation and nothing else. Any targeted tool reads the computed styles, skips hidden inputs, and avoids disallowed paths — the countermeasure costs an attacker one afternoon, once, and then works against every site using the technique.
So the realistic position is that honeypots are a cheap first filter that reduces noise, not a defence. They stop broad-spectrum form spam; they do nothing against anything aimed at you specifically, where the operator has looked at your markup. For that you need a verdict based on behavioural signals and challenge-response, which do not depend on the attacker being careless.
Put one in your forms anyway. It costs nothing, and a cheap filter in front of an expensive check means the expensive check runs on less traffic.