FormDrop › Guides › Stop contact form spam with a honeypot

Stop contact form spam with a honeypot

CAPTCHAs annoy real people. A honeypot is an invisible field humans never fill but naive bots do.

How it works

Bots that crawl for forms tend to fill every input. Add a field hidden with CSS; if it arrives filled, it's a bot. FormDrop checks a field called botcheck and silently drops such submissions — the bot even gets a success response, so it doesn't retry.

The markup

<input type="checkbox" name="botcheck" style="display:none" tabindex="-1" autocomplete="off">

Use tabindex="-1" so keyboard users never land on it.

Limits

Honeypots stop the bulk of automated spam, not a human pasting spam by hand or targeted bots that render CSS. If you still get spam, add server-side keyword filtering in your email client or a CAPTCHA as a last resort.

Point your form at one URL and get every message by email. Free for 250 submissions a month.

Get a free access key

FAQ

Does it hurt accessibility?

Not when hidden with display:none and removed from tab order.

Do I need JavaScript?

No.

Related guides

A form backend for freelancers and small agenciesplain HTML contact form without a backendReact contact form without a backendNext.js contact form without a backend