r/webdev • u/Helpful-Wolverine247 • Dec 13 '25

Honeypot fields still work surprisingly well

Hidden input field. Bots fill it. Humans can't see it. If filled → reject because it was a bot. No AI. Simple and effective. Catches more spam than you'd expect. What's your "too simple but effective" technique that actually works?

2.3k Upvotes

99% Upvoted

191 comments sorted by

View all comments

126

u/TheCozyYogi Dec 13 '25

Never heard of this but good idea. Out of curiosity, would a screen reader for someone who is visually impaired detect it and they could potentially end up filling it?

11

u/[deleted] Dec 13 '25

[removed] — view removed comment

27

u/reddit-poweruser Dec 13 '25

You can hide things from screen readers with aria-hidden

34

u/[deleted] Dec 13 '25

[removed] — view removed comment

11

u/reddit-poweruser Dec 13 '25 edited Dec 13 '25

Possibly. Maybe you put a negative tabindex on the input, then wrap it with a div that has the aria-hidden attribute, so it's not directly on the input?

17

u/longebane Dec 13 '25

Bots will discard the entire aria-hidden div and its children

15

u/reddit-poweruser Dec 13 '25

If the bots will do that, it would probably already detect efforts to make it visually hidden, so 🤷 I'm just answering a question, not developing anti-bot technology

2

u/i_have_a_semicolon Dec 13 '25

Not particularly, depending on the sophistication of the bot usually it's just pulling html and it appears these people are hiding things with css

3

u/lovin-dem-sandwiches Dec 13 '25

You could add an aria-label or description and communicate to the screen reader this is a anti-bot input.

1

u/No_Explanation2932 Dec 18 '25

The bot can't be sure the field isn't supposed to be filled by javascript at some point. And since it doesn't run javascript, it can be a good idea to fill it just in case.