Honeypot field: stop form spam with one hidden input

​

Overview

​

Enabling the Honeypot Field

1. Navigate to your dashboard
2. Open the form’s settings by selecting Edit Form Settings from the menu next to the form, or from the same menu inside the form’s submission view.
3. Go to the Spam protection section.
4. Enter the name of the honeypot field you would like to use (e.g., hp_username, website), or press the button to generate a random one. It must match the name attribute of the hidden field in your form.
5. Save your changes.

​

Adding the Honeypot Field to your Form

<form 
    action="https://crunchforms.com/form/{formID}" 
    method="post"
> 
	<label for="email">Please Enter Your Email</label> 
	<input name="email" type="email" id="email" /> 
	<div style="position:absolute; left:-9999px; width:1px; height:1px; overflow:hidden;">
		<input 
			type="text" 
			id="{honeypotFieldName}" 
			name="{honeypotFieldName}" 
			autocomplete="nope"
			tabindex="-1"
		/>
	</div>
	<button type="submit">Submit</button> 
</form>

​

Recommended Practices

• Do not use display:none — bots often ignore fully hidden fields.
• Push the field off-screen using positioning, not visibility:hidden.
• Use a natural-sounding field name (e.g., website, username, hp_name).
• Add tabindex="-1" to avoid keyboard focus.
• Set autocomplete to a non-standard value (e.g., "nope") to prevent browser autofill.

​

API Usage

​

Example Valid Submission

{
    "name": "Jane Doe",
    "email": "jane@example.com",
    "{HoneypotFieldName}": ""
}

​

Example Spam Submission

{
    "name": "Jane Doe",
    "email": "jane@example.com",
    "{HoneypotFieldName}": "Filled by bot"
}

​

Limitations

• Honeypot fields work best against low-complexity bots.
• Advanced bots may detect hidden fields. For stronger protection, consider other methods like Cloudflare Turnstile or reCAPTCHA.

​

Next steps

​

Need Help?