Honeypot fields still work in 2026
The oldest trick in form protection catches more bots than any model we run, for free. Here is how to do it properly and where it fails.
A honeypot is a form field humans cannot see and bots cannot resist. You hide it with CSS, give it a tempting name, and reject any submission where it has a value. It dates from the early 2000s, and it is still the single most cost-effective spam check we have.
Why it keeps working
Most form-spam tooling does not render pages. It fetches HTML, finds <input> elements, fills each one with something plausible for its name, and posts. A field called website gets a URL. A field called company gets a company. The bot has no way to know the field sits 10,000 pixels off-screen, and checking would cost the spammer money on every page. Cheap bots fill it; expensive bots (real browsers with humans in the loop) do not, but those are rare precisely because they are expensive.
On the traffic we see, the honeypot alone catches a large fraction of automated submissions before any model runs. It is why the rules stage in spamex exists at all.
Doing it properly
- Hide it off-screen, not with
display: none. Some bots skip fields withdisplay: noneortype="hidden". Absolute-position it 10,000 px to the left, 1 px square,overflow: hidden. - Keep it out of the accessibility tree.
aria-hidden="true"on the wrapper,tabindex="-1"andautocomplete="off"on the input. Screen readers must never land on it. - Name it like something a bot wants.
website,url,company_url. Nevername,email,phoneoraddress: a browser’s address-book autofill can fill those for a real person, and then you have a false positive with a stupid cause. - Rotate the name occasionally if you are being targeted specifically. Most sites never need to.
- Treat it as a hard verdict, silently. Do not show the visitor an error. Return the same “thanks” page and drop the message. Telling a bot it was caught only teaches it.
Pair it with a second free signal: the time between page load and submit, sent as two timestamps with the check. Humans need seconds; bots post in milliseconds.
Where it fails
- Headless browsers. A real Chromium with JavaScript sees the computed styles and can skip hidden fields. These are used for high-value targets and show up as clean-looking submissions with plausible timing. This is where identity heuristics, sender reputation and the text model take over.
- Human-operated spam. Some pitches are typed by people on a quota. No form-level trick catches those; only the content does.
- Autofill accidents. Covered above: name the field carefully.
Do not stop here
A honeypot is the floor. The rest of the pipeline exists for what climbs over it, and the ratio shifts as spammers adapt to any single site. The point is to spend nothing on the easy majority so the budget goes to the hard minority.