Glossary · Email & infrastructure
Honeypot
A honeypot, in bot detection, is a form field hidden from human view but present in the page’s HTML — automated submitters that fill in every field reveal themselves, while real visitors never see it to fill in.
The technique relies on a simple gap between how humans and simple bots interact with a form: a field hidden via CSS (rather than a hidden input type, which unsophisticated scrapers skip) is invisible to a person using a browser normally, but a bot parsing raw HTML and filling every input it finds will populate it anyway. A submission arriving with that field non-empty is discarded or flagged as automated.
Honeypots are cheap to implement and impose zero friction on legitimate users — there is nothing for a human to solve or wait on — but they only catch unsophisticated bots that do not render or evaluate CSS. More capable automated traffic, using a real headless browser, will see the field is hidden and skip it, same as a human would. For that reason honeypots function best as one low-cost layer in a stack, not a standalone defense.
Ciphera Captcha layers honeypot fields alongside proof-of-work and stateless token verification, catching unsophisticated bots for free while the harder cases are handled by the adaptive computational challenge.