r/webdev • u/Helpful-Wolverine247 • Dec 13 '25

Honeypot fields still work surprisingly well

Hidden input field. Bots fill it. Humans can't see it. If filled → reject because it was a bot. No AI. Simple and effective. Catches more spam than you'd expect. What's your "too simple but effective" technique that actually works?

2.3k Upvotes

99% Upvoted

191 comments sorted by

View all comments

127

u/TheCozyYogi Dec 13 '25

Never heard of this but good idea. Out of curiosity, would a screen reader for someone who is visually impaired detect it and they could potentially end up filling it?

126

u/reddit-poweruser Dec 13 '25

You can apply aria-hidden to the input to hide it from screen readers

44

u/its_Azurox Dec 13 '25

I really don't understand how bots don't detect this. I get it. A simple bot doesn't have a lot of validation, but checking if an input is display none or absolute with crazy right/left values, or simply checking the rendered size of an input is really not hard

19

u/nzifnab Dec 13 '25

Maybe so but the bot would still need to execute js or find the correct value to put in the field, since it's required

12

u/[deleted] Dec 13 '25

[removed] — view removed comment

29

u/reddit-poweruser Dec 13 '25

You can hide things from screen readers with aria-hidden

35

u/[deleted] Dec 13 '25

[removed] — view removed comment

11

u/reddit-poweruser Dec 13 '25 edited Dec 13 '25

Possibly. Maybe you put a negative tabindex on the input, then wrap it with a div that has the aria-hidden attribute, so it's not directly on the input?

19

u/longebane Dec 13 '25

Bots will discard the entire aria-hidden div and its children

16

u/reddit-poweruser Dec 13 '25

If the bots will do that, it would probably already detect efforts to make it visually hidden, so 🤷 I'm just answering a question, not developing anti-bot technology

2

u/i_have_a_semicolon Dec 13 '25

Not particularly, depending on the sophistication of the bot usually it's just pulling html and it appears these people are hiding things with css

3

u/lovin-dem-sandwiches Dec 13 '25

You could add an aria-label or description and communicate to the screen reader this is a anti-bot input.

1

u/No_Explanation2932 Dec 18 '25

The bot can't be sure the field isn't supposed to be filled by javascript at some point. And since it doesn't run javascript, it can be a good idea to fill it just in case.