A honeypot field is a hidden form input that people never see and that automated scripts often fill by mistake when submitting.
On this page the word means that hidden input, not a decoy server placed on a network to watch intruders.
How it works
The field can be kept off screen or styled so a person using the form never types in it, and the server expects it to arrive empty.
Scripts that stuff every input they find often put text into the hidden field, and the site can then reject that submission.
The trick fails when a careful script leaves unknown fields blank, so a hidden field is only one cheap signal among others.
Operators should avoid announcing the field name in public comments and should still rate limit and authenticate expensive actions.
Concrete examples
- A contact form includes an off screen company fax field, and submissions that contain a fax number are discarded as automated junk.
- A registration page hides a website field from view, and a burst of signups that fill it never creates accounts.
- A comment box keeps an invisible input empty for readers, while a scraper that mirrors every input trips the check.
Protective measures
- Keep the hidden field out of the visible layout and out of the label text that a normal visitor reads.
- Reject or quarantine submissions that put any value in the field, and log only enough to tune the control.
- Combine the field with limits on repeated posts so a script that skips unknown inputs still pays a cost.
- Do not use the field name in client side hints that automated tools are likely to copy.
How CDPCaptcha helps
A proof of work check raises the cost of automated form posts by requiring fresh computation before a scripted submission is accepted.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.