Question

I’ve been reading about adding Honey pot fields to my forms for combating bots/spam. Only problem is theirs no guides or anything on where to start. Many sites say to make a field that is hidden that only the spam bot would fill out. But as I’m new to this, don’t know where I would start in my application. Could anyone give me the advice on how to set this up? I am trying to make my Devise registration page use honey pot fields.

Answer 1

The basic idea behind honeypot captchas is that you have a hidden (via CSS) field named something like “form” or “email” or “content” that (to a bot just reading the field name) looks like it should be filled in. Then, when the server looks at the submission, you make sure these hidden fields are blank. If they aren’t, then you flag the post as a bot.

Here’s a well explained example (with some code in ASP), and here’s a Rails Gem that provides honeypot captchas.

That Rails Gem I linked looks like it’s very easy to use once installed:

  <% form_tag comments_path, :honeypot => true do -%>
  ...
  <% end -%>

Although if you’re interested in learning about the approach rather than just having it implemented, I’d recommend you roll your own. If you’re rolling your own, it’s important to make sure that the field is hidden by CSS (or some other style/positioning trick) and not input type="hidden" – as otherwise the bot might not fill out the field.

As Michael Mior pointed out in the comments, it’s important to have a message next to the hidden field telling the user to leave it blank – otherwise users with screen readers might erroneously fill it in. This feature is missing from the gem I linked to – so if you’re making an accessible website (which you almost certainly should be) you may need to modify it or roll your own.

---

Keep in mind that this trick isn’t foolproof – there’s nothing stopping a bot from rendering the page and determining which fields are actually visible to the user before filling any in – but that kind of bot would be considerably more complex than one that just looked at the form html. A honeypot captcha is likely to be very effective at stopping simple bots.