Honeypot
A trap for bots: a hidden field or link no person would touch, which exposes whoever does.
What is a honeypot, and how does it protect my form or my dashboard from bots?
The name comes from the idea of leaving out a jar of honey as bait. In a form, a honeypot is a field invisible to real people: a human never fills it in, but plenty of bots that fill in everything they find do, so the submission gets quietly discarded without making anyone solve a puzzle.
It also exists at a different scale, as decoy routes with names typical of admin dashboards. Nobody with good intentions has any reason to visit them, so whoever shows up there gets flagged.
Why it matters to your business
Contact forms and login pages get hit with automated traffic all the time, and that traffic fills up spam folders or tries passwords over and over. A honeypot is a cheap, silent defense that stacks on top of others without making the experience worse for real customers.
How we use this at Damorus
URG Technology's dashboard has decoy routes with names typical of admin panels, and whoever visits them gets flagged as a possible attacker. Those stack on top of an invisible anti-bot check from Cloudflare Turnstile, a wait time that doubles with every failed password, and a blocklist with manual unblocking. In the forms we have published so far we do not yet use a honeypot field; it is one of the improvements still on our list.
Need this on your project?
I want my free mockup →