Honeypot vs CAPTCHA for contact forms
A honeypot catches bots by letting them give themselves away. A CAPTCHA catches them by setting a test. One is invisible and free; the other costs your visitors effort.
The short answer
A honeypot is a hidden field that people never see but simple bots fill in, so filled-in forms are rejected. It is invisible and private, but smarter bots skip hidden fields. A CAPTCHA tests every visitor and stops more bots, at the cost of effort and third-party scripts. The strongest choice is a honeypot plus a time check and a server-signed token, which together stop more than a CAPTCHA with no visitor effort.
How a honeypot works
You add an extra field, for example "Website address (leave empty)", and hide it with CSS. People never see it; screen readers are told to skip it. Simple bots fill every field they find, including this one. Your server rejects any form where the hidden field has a value, and answers with a normal "thank you" so the bot learns nothing.
Tip: give the field a believable name and don't use type="hidden", which bots know to skip. Hide it with CSS instead, and set autocomplete="off" so browsers don't fill it for real people.
Honeypot vs CAPTCHA compared
| Honeypot | CAPTCHA | |
|---|---|---|
| Visitor effort | None | Some to a lot |
| Accessibility | Good, if labelled | Often poor |
| Third parties | None | Usually |
| Stops simple bots | Yes | Yes |
| Stops smarter bots | Not alone | Many, not all |
| Stops human spammers | No | No |
The better answer: honeypot plus
A honeypot on its own is not enough, but it is the right first layer. Add a minimum time before sending and a one-time token signed by your server, and you catch simple bots (honeypot), fast bots (time) and bots that skip your page (token), still with nothing for your visitors to do. See how to stop bots from submitting your contact form.
Common questions
Do honeypots still work?
Yes, against the large share of spam sent by simple scripts. They should be one layer among several.
Can a honeypot block real people?
Only if a browser fills it in automatically. Turning off autocomplete on the field and hiding it with CSS (not type="hidden") avoids this.
Should I use both a honeypot and a CAPTCHA?
Start with a honeypot, time check and token. Add a CAPTCHA-type check only if your spam log shows bots still getting through.