Menu

free tool

Free honeypot generator for your contact form

A honeypot is a text field that real visitors never see and never fill, hidden off screen and kept out of the tab order. A bot that fills every input it finds fills this one too, and your server uses that value to discard the submission while answering as if it succeeded. The code below works with any HTML form and any backend.

A honeypot does not stop bots that parse the CSS and skip hidden fields, or people paid to paste spam by hand. Treat it as the first filter, not the only one: validate on the server, limit how often one address can post, and keep a review folder for what gets through. Most sites get rid of the bulk of their form spam this way without a CAPTCHA.

Start freeHow mailcontact filters spam

honeypot builder

Choose a name, a hiding technique and copy the code.

Paste the HTML inside your existing form, next to the email and message fields. The default matches what mailcontact forms already carry, so a form built with our generator needs nothing more.

Pick a name a bot would expect to fill. Avoid words like “honeypot” or “trap”. mailcontact forms must keep company_website.

Visitors never see it. It makes the field look ordinary to a bot that reads labels.

Adds a hidden _t field stamped at page load and a small script that refuses a submit under 3 seconds. A person needs longer than that to write a message; most bots do not wait.

The hidden field does nothing on its own: your backend has to read it and discard filled submissions. Examples in Node (Express), PHP and Python (Flask).

honeypot.html
<div aria-hidden="true" style="position:absolute;left:-10000px;width:1px;height:1px;overflow:hidden;">
  <label>Website
    <input name="company_website" type="text" tabindex="-1" autocomplete="off" />
  </label>
</div>

using the field

What the generated code does

Invisible to visitors

The wrapper is moved far outside the page and hidden from assistive technology. The input is out of the keyboard tab order and excluded from browser autofill, so a real person cannot fill it by accident.

Your server decides

The field only works if the backend reads it. Enable the server-side example to see the check in Node, PHP or Python: a filled trap gets the normal success response and nothing is stored or sent.

Built into mailcontact forms

mailcontact endpoints already check the company_website field, discard filled submissions and add rate limits and a Spam folder. Build the whole form with the free contact form generator and the honeypot is included.

faq

Honeypot fields, answered

Does a honeypot field cause problems for screen readers?

Not when the wrapper carries aria-hidden="true" and the input has tabindex="-1", as the generated code does. Screen readers skip the field entirely and keyboard users never land on it. Keep both attributes if you edit the markup: a visitor who reaches the field and types in it would be discarded like a bot.

Can browser autofill or a password manager fill the honeypot?

It can happen when the field name looks like something the browser has saved, which is why the generator sets autocomplete="off" and places the input off screen. Test it: let your browser autofill the visible fields, then inspect the hidden one. If it has a value, choose another name. A legitimate submission with a filled trap is the worst outcome, because the visitor sees a success message and you never get the message.

Why move the field off screen instead of using display: none?

Spam bots that read CSS or the DOM look for display:none, visibility:hidden and type="hidden" because those are the classic honeypot markers, and they leave such fields empty. A field positioned far outside the viewport still looks like a normal text input to them. The off-screen technique keeps the trap effective against more bots; display:none is offered for sites that cannot use positioning, with that trade-off made clear.

Why not just add a CAPTCHA?

A CAPTCHA puts work on every real visitor, hurts accessibility and still gets solved by farms and by current image models. A honeypot costs visitors nothing. It will not stop every bot, so combine it with server-side validation, rate limits per address and per form, and a review folder for the rest. That combination handles most contact form spam without a puzzle.

go further

Spam protection beyond the honeypot

Spam protection referenceReduce contact form spam without CAPTCHAFree contact form generatorForm API reference

Let mailcontact handle the rest of the spam.

Point your form at a free mailcontact inbox: honeypot check, rate limits and a Spam folder are included. Get an email alert when someone real writes.

Create your free form

No credit card needed. Free includes one project and 50 form messages per month.