Honeypot

Stop form spam without a CAPTCHA: a hidden botcheck field that people never see and bots fill in. How it works and how to add it.

Most form spam comes from simple bots that load a page, find every input and fill each one in. A honeypot exploits that: it is a field that people never see and never touch, so any submission that fills it in was almost certainly not made by a person. It costs your visitors nothing, which is why every SilentForms example includes one.

Add it to your form#

Put this input anywhere inside the <form>:

<input type="checkbox" name="botcheck" style="display: none;" tabindex="-1" autocomplete="off">

A complete form:

<form action="https://silentforms.com/api/submit" method="POST">
  <input type="hidden" name="accessKey" value="YOUR_ACCESS_KEY_HERE">

  <label for="name">Name</label>
  <input id="name" type="text" name="name" required>

  <label for="email">Email</label>
  <input id="email" type="email" name="email" required>

  <label for="message">Message</label>
  <textarea id="message" name="message" required></textarea>

  <input type="checkbox" name="botcheck" style="display: none;" tabindex="-1" autocomplete="off">

  <button type="submit">Send</button>
</form>

honeypot and _gotcha are accepted as the field name too, so a form moved from Web3Forms or Formspree keeps its honeypot without changes.

How it works#

SilentForms looks at the honeypot field on every submission:

Not sent, empty, or false: a normal submission. An unchecked checkbox is not sent by the browser at all, so a real visitor's submission never includes it.
Any other value: treated as spam.

Each attribute in the input has a job:

Attribute	Why
`type="checkbox"`	An unchecked box is omitted from the request, so there is nothing a real browser could accidentally send.
`style="display: none;"`	Hides it from sighted visitors and from screen readers.
`tabindex="-1"`	Keeps it out of the keyboard tab order, so nobody tabs into it and presses Space.
`autocomplete="off"`	Asks browsers and autofill tools to leave it alone.

Keep all four. Hiding the field with display: none alone is usually enough to keep people away from it, but the other attributes cover keyboard users and autofill.

Bots that parse the HTML see a checkbox named botcheck and, in their eagerness to fill everything, tick it.

What happens to caught submissions#

A submission that trips the honeypot is not emailed and not sent to your webhook. The visitor (the bot) still gets the usual success response: the normal JSON message, or a redirect to the thank-you page. That is deliberate. A bot that got an error would learn to leave the field alone; a bot that sees success moves on.

Caught submissions are kept in the form's spam view in the dashboard for 7 days and then deleted automatically. Look there if you suspect a real message was caught.

False positives#

Because an unchecked checkbox is never sent, a real visitor using an ordinary browser cannot trip it. Problems come from changes to the field:

It became visible. A CSS framework, theme or page builder may restyle checkboxes or strip inline style attributes. Check the live page: if you can see the box, a visitor can tick it.
It was changed to a text input. Password managers and autofill extensions fill text inputs they think they recognise. autocomplete="off" discourages this, but not every extension honours it. Keep it a checkbox.
JavaScript sends it. Code that builds the request from a framework's form state may send botcheck: true or "on". Send false, an empty string or leave it out. Object.fromEntries(new FormData(form)) leaves it out automatically while it is unticked.

If test submissions show success but never arrive, the spam view tells you straight away whether the honeypot is the cause.

In JavaScript frameworks#

In JSX the attributes are spelled differently, and the style is an object:

<input type="checkbox" name="botcheck" style={{ display: 'none' }} tabIndex={-1} autoComplete="off" />

If your form library controls every input, register the honeypot like any other field with a default of false, and never set it in code.

Combine it with a CAPTCHA#

A honeypot stops bots that fill in everything, which is most of them. It does not stop a bot written for your specific form, or a person paid to submit spam. If spam still gets through, add a CAPTCHA on top. Keep the honeypot: it is free, invisible, and catches the bulk of bots before the CAPTCHA even matters.

Cloudflare Turnstile is usually invisible to visitors.
hCaptcha and Google reCAPTCHA are the other supported providers.

You can also restrict the form to your domain so a copied key cannot be used on another site.