Honeypot Field Generator — Stop Form Spam Without CAPTCHA

Honeypot field name

Pick something innocuous bots will eagerly fill — url, website, homepage, fax

1. Drop this HTML inside your <form>

<!-- Hidden honeypot field — humans never see it, bots always fill it -->
<div class="lf-hp" aria-hidden="true" style="position:absolute;left:-9999px;top:-9999px;width:1px;height:1px;overflow:hidden;">
  <label for="website_url">Leave this field empty</label>
  <input type="text" id="website_url" name="website_url" tabindex="-1" autocomplete="off" />
</div>

2. Reject filled submissions on the server

// Server-side validation (Node / Deno / any language)
if (request.body["website_url"] && request.body["website_url"].length > 0) {
  // Honeypot tripped — silently discard, return 200 so the bot doesn't retry.
  return new Response("ok", { status: 200 });
}

// Otherwise process normally.

Frequently asked questions

Is honeypot better than CAPTCHA?

For most public forms, yes — zero friction, zero accessibility cost, blocks the majority of automated spam. Pair it with reCAPTCHA only on high-value forms.

Why hide the field with CSS instead of type="hidden"?

Bots skip type="hidden" fields but fill out anything they see in the DOM. CSS-hiding tricks them into completing the trap.

Where do I validate the field?

On the server, before processing the submission. If the honeypot field is non-empty, discard the request silently.

Build the form behind the tool

LemForms is the form builder this tool plugs into — calculations, conditional logic, embeds, webhooks, and a real submissions dashboard. Free to start.

Try LemForms free

Frequently asked questions

Build the form behind the tool

More free tools