Honeypot Fields

Honeypot fields are invisible fields added to your form schema that real users never see or fill out. Automated bots, which tend to fill every field they find, give themselves away by submitting data in these hidden fields.

How it works

When a submission arrives with data in a honeypot field, Postbox immediately flags it as spam with 100% confidence. No AI analysis needed - the presence of data in a honeypot field is a definitive signal of bot activity.

Honeypot filtering is part of Postbox’s Standard Protection spam strategy. It runs before and independently of Intelligent Analysis (the LLM-powered spam filter), so you can use honeypots on their own or as an additional layer alongside AI detection.

Adding a honeypot field

When creating a form or editing a schema, check the Honeypot checkbox on any field to mark it as a honeypot.

A few rules apply:

• A honeypot field cannot be required. These two options are mutually exclusive - enabling one disables the other.
• Honeypot fields are hidden from legitimate users in the public form preview.
• You can have multiple honeypot fields on a single form.

Best practices

Use realistic field names. Bots are more likely to fill fields that look like real inputs. Good honeypot names:

• website
• phone
• company
• fax
• url

Avoid obvious names. Don’t name your honeypot field honeypot, trap, bot-check, or anything that signals its purpose. Sophisticated bots may skip fields with suspicious names.

Cost

Honeypot detection is completely free. It uses zero AI credits - unlike Intelligent Analysis, which costs $0.005 per submission. If cost is a concern, honeypots give you a strong first line of defense at no charge.

Limitations

Honeypot fields only catch automated bots that blindly fill every field. They will not catch:

• Manual spam submitted by a human
• Bots sophisticated enough to skip hidden fields
• Spam that arrives through direct API calls without a form UI

For those cases, consider enabling Intelligent Analysis alongside your honeypots.