If you fill out our contact form right now, there’s a field on the page you’ll never see, never click, and never fill in — and that’s exactly the point. It’s called a honeypot, and it’s one of the simplest, most effective ways to stop automated spam without ever inconveniencing a real visitor.
How it actually works
The honeypot is a form field — usually asking for something like a website URL — positioned off-screen with CSS, hidden from sighted users and skipped by screen readers, but still technically present in the page’s underlying HTML. A real person filling out a form never sees it, never interacts with it, and submits with it left blank, exactly as intended.
Automated bots don’t browse a page the way a human does. Most of them scan the raw HTML and fill in every field they find, because they’re not rendering the page visually — they’re just looking for form fields to populate. The moment that hidden field comes back with anything in it, the server knows for certain a bot submitted the form, and can quietly discard it without ever bothering a real user with a CAPTCHA or an extra verification step.
“A honeypot doesn’t ask a real visitor to prove they’re human. It just waits for a bot to prove it isn’t, by doing exactly what bots do and humans don’t.”
Why we use this instead of a CAPTCHA
CAPTCHAs work, but they add friction for every single visitor to block a minority who were never going to submit anyway — solving distorted text or clicking image grids on every legitimate submission to catch the occasional bot. A honeypot catches the same automated traffic with zero added steps for anyone actually filling out the form. We pair it with server-side nonce verification (proving a submission genuinely came from our own form, not a replayed or forged request) rather than adding visible friction on top.
The takeaway
The best spam protection is often the kind a real visitor never notices at all. A honeypot field costs nothing in user experience and catches the overwhelming majority of automated form spam — no puzzles, no delays, just a trap that only a bot would ever walk into.
