Honeypot

Overview

A honeypot is a technique that adds a hidden field humans can't see to a form and flags the request as a bot if that field has a value. Humans don't notice the field exists, so they leave it empty. Bots mechanically fill in every field on the form, so they put a value in the hidden field too. A honeypot uses this difference to detect bots.

How to implement it

Implementing a honeypot is simple. You add an input field to the form that looks the same as a normal field, then use CSS styles such as "display: none" or "position: absolute; left: -9999px" to move it off the screen. On the server side, you reject the request if this field contains a value.

Giving the field a name that bots are likely to fill in automatically, like email2 or website, raises the detection rate. On the other hand, a name that's obviously a honeypot, like hp_field, may be avoided by advanced bots.

Limits and combining it with other defenses

A honeypot has the advantage of taking little effort to implement and having little impact on the user experience. However, advanced bots can analyze the CSS, find hidden fields, and avoid filling them in. Also, a browser's autofill can put a value into the hidden field, so a legitimate user may be wrongly flagged.

That's why a honeypot isn't used on its own. Instead, it's designed as one layer of a layered defense, combined with Proof of Work and rate limiting. The roles are divided: the honeypot is a cheap first-line measure that filters out simple bots, and any bots that slip through are handled by Proof of Work or rate limiting.