Implementing a honeypot field to block spam bots

Implementing a honeypot field to block spam bots

Adding a honeypot field to your HTML forms is a simple, effective way to catch and block automated spambots without impacting real users. Below is an example Subscribe form that uses a hidden honeypot field named language, along with two CSS techniques to keep it invisible.


By adding this small honeypot field and a quick server-side check, you can reduce automated spam submissions with virtually no extra effort and no impact on legitimate users.

Sample code

<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Exatom sample - Subscribe form with Honeypot</title> <style> /* A) Simple honeypot hiding technique */ #subscribeForm .language { display: none; } /* B) Advanced honeypot hiding technique */ #subscribeForm .language { position: absolute; left: -9999px; transform: scale(0.00001); opacity: 0.00001; z-index: -9999; pointer-events: none; overflow: hidden; } </style> </head> <body> <form id="subscribeForm" method="POST"> <div> <label for="name">Name:</label> <input type="text" id="name" name="name" required autocomplete="name"> </div> <div> <label for="email">Email:</label> <input type="email" id="email" name="email" required autocomplete="email"> </div> <!-- Honeypot field, that bot will fill in --> <div class="language"> <label for="language">Language:</label> <input type="text" id="language" name="language" autocomplete="none"> </div> <button type="submit">Subscribe</button> </form> </body> </html>

How It Works

Honeypot Field
  1. The ⁠<div class="language"></div> block contains an innocuous field that human visitors never see.
CSS Hiding Techniques
  1. Simple (⁠display: none;): quick and straightforward, but some advanced bots might detect it.
  2. Advanced (off-screen, zero opacity, scaled down): harder for bots to spot.
Validation
  1. On form submission, check whether the ⁠language field is empty.
  2. If it contains any value, assume a bot filled it out and reject or discard the submission.
  3. If it’s empty, process the subscription normally.

Benefits

  1. No extra JavaScript, it works even when scripts are disabled.
  2. Zero impact on user experience.

Implementation Tips

  1. Name the field inconspicuously: avoid obvious names like ⁠honeypot - use something a human would ignore.
  2. Validate strictly: on the server, discard any submission where the honeypot field is non-empty.
  3. (optional) Combine with rate limits: for extra protection, limit the number of requests per IP per hour.