Search for a command to run...
Protect your forms from spam submissions with the honeypot technique
An architect by trade, practicing architecture in the Cloud. 7x AWS Certified, AWS Community Builder, Serverless advocate, Vue enthusiast.
No comments yet. Be the first to comment.
A clean serverless pattern for streaming real-time AI workflow responses with Server-Sent Events and AWS Lambda
Emails not reaching the inbox due to template Rendering Failure
A secure, efficient, and hassle-free way to run data analytics queries
How to run your AWS Lambda functions with a fixed IP up to 10x cheaper.
Using the API Gateway - SQS integration to create scalable webhook listeners and validate the requests at the API Gateway level
The honeypot field is an antispam technique, a bait form input used to lure spam bots, they'll "see" a field and fill it up with their junk.
This input is hidden from normal users, humans will leave it empty because they won't see it, so it's easy to tell when a form submission is spam or not.
The honeypot will help you catch the majority of the dumb spam bots, however, bots get smarter and harder to trick, so it's not bullet-proof.
<form method="POST" action="form-handler.php">
<!-- ... form fields ... -->
<!-- this is the honeypot field -->
<div style="position: absolute; left: -9999px">
<label for="website-url">Your website</label>
<input type="text" id="website-url" name="url" tabindex="-1" autocomplete="nope" />
</div>
<!-- ... form fields ... -->
</form>
Adding a honeypot requires getting your hands dirty with some code, update the form HTML and backend code. Below are my tips on how to make the honeypot more effective and avoid silly mistakes.
Make the field look as legit as possible so even the smarter bots will be tricked into filling it.
✅ set the input type="text" or type="email"
✅ use a common name attribute like email, phone, address, i.e. name="url"
Bots get smarter every day, they can recognize honeypot patterns and we don't want that.
❌ don't use type="hidden"
❌ don't use name="honeypot" or another name that would give a hint it's a trap
❌ don't use "display: none" - most bots won't fill the CSS hidden inputs
❌ don't use "hidden" or similar in the class name if you're using that instead of inline styles
✅ Wrap the input & its label in a div tag and position it outside the viewport.
<!-- honeypot field -->
<div class="url-field-wrapper">
<label for="website-url">Your website</label>
<input type="text" id="website-url" name="url" tabindex="-1" autocomplete="nope" />
</div>
<!-- the rest of the form -->
.url-field-wrapper {
position: absolute;
left: -9999px;
}
Browsers have functionalities that can be easily neglected and make legit users get caught by our spam bait input. Yep, false positives. There are 2 input attributes we have to set to avoid:
🚨 set tabindex="-1", tech-savvy visitors will use the tab key to navigate through form fields, if the tabindex attribute is not set they'll be able to focus and accidentally fill in the honeypot
🚨 set autocomplete="nope", avoid browsers' autocomplete feature to fill in the honeypot field, especially when using a common name attribute
If the backend validation fails because the honeypot was filled, don't throw an error, silently discard the submissions and show a success message. Make the spammer think their junk went through.
// require the honeypot field to be present but empty
if(!isset($_REQUEST['url']) || !empty($_REQUEST['url'])) {
// hello spammer!
echo 'Thank you for submission!';
}
As mentioned previously, the honeypot field won't stop all the SPAM submissions but will help to catch at least half of it. If you struggle with spam submissions you'll want to use the honeypot in conjunction with other methods.
The general go-to solution is to add a CAPTCHA, I recommend against it, until it really hurts.
It's effective, but why punish our users because we have a problem with SPAM? It's our problem, not theirs, let's try to address it.
I've had excellent results filtering the form submissions through Akismet, try that before CAPTCHA.
Shameless plug: I run a service that will help you deal with form processing & SPAM protection
👉 POST2