Honeypot field
Use a visitor-hidden botcheck field to catch simple automated submissions.
Add the botcheck field
Keep the agreed name, remove it from keyboard navigation, and hide it without relying on JavaScript. Legitimate submissions should leave it empty.
HTML — honeypot field
<input type="text" name="botcheck" tabindex="-1"
autocomplete="off" aria-hidden="true" style="display:none" />Match the configured name
The server and page must agree on the honeypot field. Do not reuse a real business field or include the value in notifications.
Do not rely on it alone
Sophisticated bots skip common honeypots, and some legitimate automation may fill hidden controls. Combine the field with rate limits and reviewable signals.
Documentation reviewed on October 20, 2026Suggest an improvement →