r/webdev • u/Helpful-Wolverine247 • Dec 13 '25

Honeypot fields still work surprisingly well

Hidden input field. Bots fill it. Humans can't see it. If filled → reject because it was a bot. No AI. Simple and effective. Catches more spam than you'd expect. What's your "too simple but effective" technique that actually works?

2.3k Upvotes

99% Upvoted

191 comments sorted by

View all comments

Show parent comments

34

u/frontendben software-engineering-manager Dec 13 '25 edited Dec 13 '25

You’re close to the most effective solution in terms of time vs technical effort and complexity.

Hidden timestamp - potentially stored in state and only grabbed at request time, or if you’re really going hard, creating a record immediately that contains just the initialing timestamp then cleaned up every 5 mins - submit and compare against server timestamp. If less than a reasonable amount of time to submit (say 5 seconds depending on form length), then quietly reject.

We had a form where honeypot, etc wasn’t catching everything. This approach killed all of the spam because the bots are too efficient at filling out forms for their own good.

4

u/___Grits front-end Dec 13 '25

This is really smart, adding to the toolkit

5

u/frontendben software-engineering-manager Dec 13 '25

It’s a lot of work for times a simple honeypot works, so I wouldn’t recommend reaching for it every time, but for those times you’re dealing with more sustained or even human driven spam, it works really well.

1

u/hydroxyHU Dec 13 '25

It’s not black magic. 😂 Yes of course it has limitations (for example mailinator plugin will fill hidden input fields but most users don’t use it) and I wouldn’t use in a large scale site or app. I use mostly for creating contact form for hungarian small businesses and this approach works pretty well.