# Honeypot field

A honeypot field is a form input hidden from human visitors but visible to automated bots, which tend to fill in every field they find. A submission with the hidden field filled in is treated as a bot, so spam is filtered without asking real people to solve a CAPTCHA.

Canonical page: https://getlaunchlist.com/glossary/honeypot-field. Updated 2026-10-15.

## How a honeypot field works

A honeypot is an extra input in your form that real visitors never see. It is moved off-screen or hidden with CSS, so a person filling in the form leaves it empty without knowing it exists. Many spam bots don't render the page the way a browser does. They read the form's HTML and fill in every input they find, including the hidden one. When a submission arrives with that field filled in, you know a person did not send it.

The name comes from security work, where a honeypot is a decoy that attracts attackers so they reveal themselves.

## Building one that real people never trip

- **Give it a believable name.** "website" or "company_website" attracts bots; "honeypot" warns them.
- **Hide it with CSS, off-screen.** Some bots skip fields that are marked hidden in the HTML itself.
- **Switch autocomplete off** on the field, so browsers and password managers don't fill it for a real person.
- **Keep it out of reach** of keyboards and screen readers, so nobody tabs into it or hears it announced.
- **Don't tell the sender why they were refused.** A generic message gives a bot's author nothing to fix.

## The time trap: a honeypot's partner

A second invisible check pairs well with a honeypot: timing. A person needs a few seconds to read a form and type an email. A bot can fill it in and send it in milliseconds. Recording when the form was shown and refusing submissions that arrive faster than a person could type catches bots that know to skip hidden fields.

## Honeypot vs CAPTCHA

| | Honeypot field | CAPTCHA |
| --- | --- | --- |
| What a real visitor sees | Nothing | A puzzle, a checkbox or a challenge |
| Signups lost to friction | None | Some |
| Catches simple bots | Yes | Yes |
| Catches determined, site-specific bots | Often not | More often |
| Setup | A hidden field and a check on the server | Keys from a provider and a widget on the form |

## Where honeypots fall short

A honeypot does nothing against a person typing in a fake address, someone using a [disposable email](https://getlaunchlist.com/glossary/disposable-email), or a bot built for your site. Those need other layers: rate limits per IP address, checks on the address itself, and confirmation by email. [Double opt-in](https://getlaunchlist.com/glossary/double-opt-in) closes the biggest gap, because a fake address can never click a confirmation link.

## Honeypot fields in LaunchList

Every LaunchList form includes a hidden field only bots fill in, plus a check for forms sent in under two seconds and rate limits on repeated attempts. They run on your Launch page and on forms you embed on your own site with a [waitlist widget](https://getlaunchlist.com/glossary/waitlist-widget), with nothing to switch on. On the default setting, a submission that fills in the hidden field is refused, and the visitor sees a general message that doesn't say which check stopped it.

These are the first layers of [Contact Trust](https://getlaunchlist.com/features/contact-trust), which also scores each signup's address, device and network and holds anything suspicious for you to review. If you are under attack, you can add your own Turnstile, reCAPTCHA or hCaptcha keys and the challenge appears on your forms. Signups you make in test mode skip the checks, so filling in your own form ten times never looks like an attack.

## Frequently asked questions

### Does the honeypot technique still work?

Yes, as one layer. Simple bots still fill in every field and get caught without anyone noticing. Bots written for a specific site, or ones that drive a real browser, can skip a hidden field, so a honeypot works best alongside rate limits, a minimum fill-in time and email checks.

### Is a honeypot better than a CAPTCHA?

For the people signing up, yes: a honeypot is invisible and asks nothing of them, while a CAPTCHA asks every visitor to prove they are human and loses some real signups. A CAPTCHA stops more determined bots, so many teams use a honeypot by default and add a CAPTCHA only to a form under active attack.

### Can a honeypot field block real people?

It can if it is built carelessly. Browser autofill and password managers sometimes fill hidden fields, and screen readers can announce them. Switching autocomplete off on the field and hiding it from assistive technology and keyboard focus prevents both.

### What should I call a honeypot field?

Something a bot expects to fill in, such as website or company_website, rather than an obvious name like honeypot or trap. Bots look for familiar field names, so a believable one catches more.

## Related terms

- [Disposable email](https://getlaunchlist.com/glossary/disposable-email.md)
- [Double opt-in](https://getlaunchlist.com/glossary/double-opt-in.md)
- [Waitlist widget](https://getlaunchlist.com/glossary/waitlist-widget.md)