What is a honeypot field?

Give the input an ordinary name such as website or company_url, position it off-screen, and add an aria-hidden attribute plus tabindex="-1" so assistive technology and keyboard users never reach it.

A script reading the form sees a normal text input and fills it. Your handler checks the field on submit: if it has any value, drop the submission without an error message. Silence teaches the bot nothing.

Pair it with a timing check. A form completed in under two seconds was not typed by a person, and the two signals together catch most of what a signup form faces without asking anyone to identify a traffic light.

None of this tells you whether a human's address is real, which is why signup forms usually run a honeypot and a verification call side by side.

Say your newsletter form normally collects 25 signups a day. One morning the dashboard shows 340 new subscribers since midnight, arriving about one a minute, each with a plausible name and an address at a big webmail provider. Welcome emails went to all of them, and 60 have already bounced.

This is what a script working through your form looks like. Some of those addresses belong to real people who never asked for your mail, which is worse than a bounce, because they're the ones who'll press the spam button.

With a honeypot in place, the same attack looks different in your logs. The script fills every input it finds, including the one people can't see, and your handler discards those posts. You might record 338 rejected submissions and two that got through from a smarter bot. Those two can be left to a verification call and a confirmation email to deal with.

Browsers and password managers fill in forms on a person's behalf, and they don't always skip fields the person can't see. If your hidden input has a name that autofill recognizes, a real visitor's browser may complete it for them. Your handler then drops a genuine signup without a word, and you never find out.

Guard against that in two ways. Set autocomplete to off on the hidden field, and pick a name that sounds like a normal input without matching the standard autofill tokens for things like organization or URL. Then test the form yourself in Chrome and Safari with saved details and a password manager switched on.

For the first week, log what the honeypot catches instead of discarding it blind. Skim the rejected entries. If any of them look like customers, with company domains and sensible names arriving at a human pace, your trap is catching people and needs adjusting before you trust it.