On this page
Your options, compared
How a honeypot compares with the other ways to keep bots out of a form.
| Approach | Cost to visitors | Accessibility | Catches | Setup |
|---|---|---|---|---|
| Visual CAPTCHA | A puzzle every time | Hard for many | Most bots | Widget and keys |
| Invisible challenge, such as Turnstile | Usually none | Good | Most bots | Widget and keys |
| Honeypot field | None | Unaffected | Blind form-filling bots | One input |
The minimal integration
This form already carries a honeypot: the off-screen _mtf_honeypot input just above the button. MakeTheForm checks it on every form by default, so there is nothing to switch on.
<form action="https://mtform.co/f/your-form-key" method="POST">
<label>
Name
<input name="name" autocomplete="name" required>
</label>
<label>
Email
<input type="email" name="email" autocomplete="email" required>
</label>
<label>
Message
<textarea name="message" required></textarea>
</label>
<!-- Spam trap: hidden from people, tempting to bots. Leave it empty. -->
<input
type="text"
name="_mtf_honeypot"
tabindex="-1"
autocomplete="off"
aria-hidden="true"
style="position:absolute;left:-9999px"
>
<button type="submit">Send</button>
</form>The honeypot is the _mtf_honeypot input. Your Spam page counts what it catches, so you can see it working.
Moved off-screen rather than hidden, taken out of the tab order, hidden from screen readers, and given a name no autofill recognises.
<div aria-hidden="true" style="position:absolute;left:-9999px;">
<input name="_mtf_honeypot" type="text" tabindex="-1" autocomplete="off">
</div>Step by step
- 1
Add one extra text input
Put a normal text input inside your form. It must be type="text", not type="hidden": bots know to leave hidden inputs alone.
- 2
Move it off-screen with CSS
Wrap it in an element positioned far off-screen. Avoid display:none and visibility:hidden, which some bots read from the stylesheet.
- 3
Hide it from keyboards and screen readers
Give the input tabindex="-1" and the wrapper aria-hidden="true", so keyboard and screen-reader users never land on it.
- 4
Give it a name autofill will not touch
Do not label it or call it company, website, phone or name. Browsers ignore autocomplete="off" and will fill a field that looks familiar on a real visitor’s behalf.
- 5
Reject filled submissions on the server
The check has to run where the POST lands. A bot never runs your page’s JavaScript, so a client-side check catches nothing.
Why a display:none honeypot catches less
It hides the field from people, but a bot that reads the stylesheet can see the rule and skip the field. Off-screen positioning looks like any other layout, so the bot fills it.
<!-- Easy for a bot to spot and leave empty. -->
<input name="_mtf_honeypot" type="text" style="display:none">Common pitfalls
Using type="hidden"
It is the obvious way to hide an input, and the one bots look for. A hidden input is never filled, so the trap never springs.
Fix: Use type="text" and hide the wrapper with off-screen positioning.
A name that autofill recognises
Call the field "website" or "company" and password managers fill it for real people, whose enquiries are then thrown away as spam.
Fix: Use a name with no meaning to autofill, such as _mtf_honeypot, and no visible label.
Telling the bot it was caught
An error message on a filled honeypot teaches a smarter bot to leave that field empty next time.
Fix: Answer with success and discard the submission. MakeTheForm does exactly this.
Troubleshooting
| Symptom | What’s happening | Fix |
|---|---|---|
| still spammed | Spam keeps arriving after adding the field. | Check it is not type="hidden" or display:none. If it is correct, the spam is coming from a smarter bot or a person: add server-side filtering or an invisible challenge. |
| real messages lost | Genuine visitors are being dropped. | Autofill is filling the field. Remove any label or id that reads like a real field and rename it _mtf_honeypot. |
Frequently asked questions
What is a honeypot field in a form?
A form input hidden from people with CSS. Real visitors leave it empty because they never see it; automated bots fill every field, so a value in it marks the submission as spam. The server then discards it.
Does a honeypot stop all spam?
No. It stops bots that fill forms blindly, which is most contact form spam. It does not stop a person typing spam by hand or a bot written for your specific form. For those, add server-side content filtering or an invisible challenge.
Is a honeypot field bad for accessibility?
Not when it is built correctly. With tabindex="-1" on the input and aria-hidden="true" on its wrapper, keyboard and screen-reader users never reach it. That makes it far more accessible than a visual CAPTCHA.
Is a honeypot better than reCAPTCHA?
It is a better first layer, because it costs visitors nothing. reCAPTCHA catches more determined bots but adds friction and privacy questions. Most small sites find a honeypot plus server-side filtering is enough, and add a challenge only if spam persists.
Keep going
Last reviewed by the MakeTheForm team.