Glossary
What is a honeypot field?
Definition
A honeypot field is a form input that people never see but that exists in the page code. Real visitors leave it empty. A script that fills every field fills it, and your server drops that submission.
How it works
- Add an input with an ordinary-looking name and hide it with CSS.
- Keep it out of the tab order and hidden from screen readers.
- On the server, reject any submission where the field has a value.
Where it matters
- A free first layer on contact, comment and signup forms.
- Scripts written for your specific form can learn to skip it.
In CaptchaKit
CaptchaKit does not add a honeypot for you. You can use one on the same form as the widget.
Questions
Do honeypots hurt accessibility?
They can if keyboard or screen reader users can reach the field. Hide it from assistive technology.
Is a honeypot enough?
On a quiet form, often. Under targeted attack, no.
Can I use a honeypot with a CAPTCHA?
Yes. The checks are independent.
Source
- OWASP Bot Management and Anti-Automation Cheat Sheet (Honeypots and Tarpits) (checked 2026-10-18)
Related
Protect your forms with a game
Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.
Get started →Pay what you want. Start free.