Honeypot Field Generator: No-CAPTCHA Spam Block
Generate a copy-paste invisible honeypot input for your HTML form — the CAPTCHA-free way to block automated bot submissions.
Honeypot Field Generator: No-CAPTCHA Spam Block
This tool generates a hidden `_gotcha` honeypot field: an invisible input real humans never see or fill, but automated bots fill because they complete every field in the DOM. Paste the markup anywhere inside your form and reject any submission where the field arrives non-empty — that check is what turns a normal form into a honeypot form. Form2Lead runs the check server-side on every endpoint, combined with per-IP rate limiting, so you get the protection people associate with a honeypot captcha without ever showing one.
<input type="text" name="_gotcha" style="display:none !important" tabindex="-1" autocomplete="off" />
Server-side rejection check (any backend)
// Reject submissions where the honeypot field is filled (bots fill it, humans don't)
if (body.get('_gotcha')) {
return Response.json({ ok: false, error: 'spam' }, { status: 400 });
}Using Form2Lead? The honeypot check runs automatically on every endpoint — just paste the input into your form and submissions with a filled _gotcha field are silently rejected. Read the spam-protection docs.
Tool FAQ
Why does the honeypot field need to be invisible?
The field is hidden with CSS so human visitors never see or fill it. Automated bots scrape the form and fill every input — so a value in the hidden field is a reliable bot signature.
Does Form2Lead check the honeypot automatically?
Yes. Every Form2Lead endpoint rejects submissions whose `_gotcha` field is non-empty, and combines that with per-IP rate limiting and allowed-origin checks.
Where should I place the honeypot field in my form?
Anywhere between the opening and closing <form> tags. Bots parse the raw DOM rather than the visual layout, so position does not affect detection — many developers place it near the email input or just before the submit button. Keep the generated attributes intact: the inline style hides it, tabindex="-1" keeps keyboard users out of it, and autocomplete="off" stops password managers from filling it.
Is a honeypot captcha accessible for real visitors?
Yes — that is its main advantage over a visual challenge. Screen readers skip the display:none field, keyboard users never tab into it, and there is nothing to solve, squint at, or fail. A honeypot form presents zero friction to humans while still catching the automated submissions a CAPTCHA targets.
Will a honeypot field block every bot?
No single filter does. Simple scraping bots fill the honeypot and are rejected instantly; sophisticated bots can skip hidden fields. That is why Form2Lead layers the honeypot with per-IP rate limiting and CORS allowed-domain checks, so scripted floods and cross-site replays are throttled or rejected even when the honeypot stays empty.
Does adding a honeypot change how my form submits?
No. The field is submitted along with everything else in the normal POST — there is no extra script, no network call, and no change to your form’s action or method. You only need server-side logic that rejects non-empty honeypot values, which Form2Lead applies for you on every endpoint.