Honeypot field defined.
A honeypot field is a form input hidden from human visitors with CSS: real submissions leave it empty, so any submission that arrives with the field filled in came from a bot and can be discarded.
How a honeypot field works
Spam bots don't render your page, they parse the HTML, find every input, and fill each one before POSTing. A honeypot turns that habit against them. You add one extra field, hide it with inline CSS so no human ever sees it, and keep it out of the tab order. A person submits the form with the trap empty; a bot dutifully fills it. The server then has a perfect tell: value in the honeypot means bot, every time, with zero friction added for real visitors, which is exactly what a captcha can't claim.
FormWire runs this check server-side on every submission by default, with nothing to configure. The trap field is named fax_number out of the box, and you can rename it per form so it isn't a guessable constant across sites. Caught bots still receive a generic success response (so they learn nothing) while the submission is filed to your spam tab instead of your inbox, with the trap value stripped from the stored data.
What a honeypot buys you.
Invisible to humans
Real visitors never see the field, never fill it, and never solve a puzzle. The check costs them nothing.
Fatal to naive bots
Scripted spam fills every input it finds. One filled trap field is a definitive verdict, flagged before it reaches your inbox.
Reviewable, not silent
Flagged submissions land in a spam tab you can audit, so a false positive is a click away from being rescued.
Related questions
Because it filters bots without taxing humans. A captcha makes every real visitor pay to prove themselves; a honeypot only exists for the bots. Start with the honeypot alone and add a captcha when a specific form is being actively targeted.
When to add a captcha →Sophisticated ones try. Two habits keep the trap effective: hide the field with inline CSS rather than an external stylesheet (some bots check computed styles only when they're cheap to reach) and give it a plausible name like fax_number instead of something that announces itself, renamed per form.
Telling a bot it was caught invites it to adapt. A generic success response gives the operator no signal that the trap exists, so the same crude script keeps failing quietly.
It stops the automated bulk that makes up most of it. Targeted bots and human spam farms can leave the trap empty, which is why serious spam protection layers a honeypot with optional captchas and rate limits rather than betting everything on one check.
Cloudflare Turnstile, explained →Want to see it working?
Read the docsShip a form the bots fail quietly.
Free tier forever. No credit card required.