Skip to content

Instantly share code, notes, and snippets.

@andrewlimaza
Last active November 16, 2024 11:47
Show Gist options
  • Select an option

  • Save andrewlimaza/958826feac907114a57462bfc8d535ff to your computer and use it in GitHub Desktop.

Select an option

Save andrewlimaza/958826feac907114a57462bfc8d535ff to your computer and use it in GitHub Desktop.
Simple honeypot for an HTML form using PHP
<?php
//check if form was sent
if($_POST){
$to = 'some@email.com';
$subject = 'Testing HoneyPot';
$header = "From: $name <$name>";
$name = $_POST['name'];
$email = $_POST['email'];
$message = $_POST['message'];
//honey pot field
$honeypot = $_POST['firstname'];
//check if the honeypot field is filled out. If not, send a mail.
if( ! empty( $honeypot ) ){
return; //you may add code here to echo an error etc.
}else{
mail( $to, $subject, $message, $header );
}
}
?>
<html>
<head>
<title>HoneyPot for HTML Form Example</title>
<style>
.hide-robot{
display:none;
}
</style>
</head>
<body>
<form method="post" action="#my-form" id="my-form">
<!-- Create fields for the honeypot -->
<input name="firstname" type="text" id="firstname" class="hide-robot">
<!-- honeypot fields end -->
<input name="name" type="text" id="name" placeholder="Name" required><br>
<input name="email" type="email" id="email" placeholder="Email" required><br>
<textarea name="message" id="message" placeholder="Enter your message here" required></textarea><br>
<input type="submit">
</form>
</body>
</html>
@nsadx

nsadx commented Jun 27, 2017

Copy link
Copy Markdown

such a cool code

@saxxi

saxxi commented Jan 17, 2018

Copy link
Copy Markdown

Brilliant concept, thanks.

@andrewlimaza

Copy link
Copy Markdown
Author

Didn't see these, thanks for the feedback! Appreciate it!

@aeneas01

aeneas01 commented Oct 7, 2018

Copy link
Copy Markdown

forgive my ignorance, but how would i apply this to my phpbb board? thank you very much in advance!

@hethanna

hethanna commented Mar 3, 2019

Copy link
Copy Markdown

I'm rahter ignorent to this: do I copy & paste in code for my form? Do I have to fill in url or some?
Thanks for support! :-) hethanna

@FynnZW

FynnZW commented Apr 4, 2019

Copy link
Copy Markdown

This did not work for me:
if( $honeypot > 1 )
but this did:
if ( !empty($honeypot) )

@emiliofmartin

Copy link
Copy Markdown

Good. Thanks for all.

@jrice22

jrice22 commented Oct 3, 2019

Copy link
Copy Markdown

This did not work for me:
if( $honeypot > 1 )
but this did:
if ( !empty($honeypot) )

This worked for me! Ty

@jschaefer-workmatrix

Copy link
Copy Markdown

Thanx for the code!

<!-- Create fields for the honeypot -->
<input name="firstname" type="text" id="firstname" class="hide-robot">
<! -- honeypot fields end -->

My only question is: does this work with browsers autofill and/or password managers?
I doubt it since the field name firstname is chosen so common.
Would it not be better to use another name like "email2" or something?

@jschaefer-workmatrix

Copy link
Copy Markdown

Thanx for the code!

<!-- Create fields for the honeypot -->
<input name="firstname" type="text" id="firstname" class="hide-robot">
<! -- honeypot fields end -->

My only question is: does this work with browsers autofill and/or password managers?
I doubt it since the field name firstname is chosen so common.
Would it not be better to use another name like "email2" or something?

Just stumbled upon autocomplete="off"... maybe this is the solution!

@andrewlimaza

Copy link
Copy Markdown
Author

You can use autocomplete="off" to prevent this from auto completing, will update it.

@seluce

seluce commented Dec 29, 2019

Copy link
Copy Markdown

Pretty nice. It Works like a charme. Easy to use and very effective

@seluce

seluce commented Dec 31, 2019

Copy link
Copy Markdown

Maybe your should add this on your html input field too:
tabindex="-1"

It prevents that someone tab the input honeypot field.

@phrenos19

Copy link
Copy Markdown

Thank you! autocomplete="off" does not work for me with chrome. I just set autocomplete="random_value". Now it works :)

@vortex100

vortex100 commented Feb 27, 2021

Copy link
Copy Markdown

Many bots are now onto the "display: none" style or any style with the words "hidden" or "hide" in the name. Instead, use the following style to hide your input field:
.myblank {
opacity: 0;
position: absolute;
top: 0;
left: 0;
height: 0;
width: 0;
z-index: -1;
}

@NjRis

NjRis commented Jun 30, 2021

Copy link
Copy Markdown

Hi ! The php part didn't get reconigze in my code

@unobatbayar

unobatbayar commented Aug 12, 2021

Copy link
Copy Markdown

Brilliant.

Small performance improvement, probably indifferent in this case but in it might help if you have huge code.

Checking the return case early

Example:

if($_POST){
	//check if the honeypot field is filled out. If not, send a mail.
	$honeypot = $_POST['firstname'];
	if(!empty( $honeypot )) return;

        //proceed to send mail
	$to = 'some@email.com';
	$subject = 'Testing HoneyPot';
	$header = "From: $name <$name>";

	$name = $_POST['name'];
	$email = $_POST['email'];
	$message = $_POST['message'];

        mail( $to, $subject, $message, $header );
}

@Fortuneod

Copy link
Copy Markdown

Now, I am trying to get the whole idea of this. How does the firstname input work as the honeypot field?

@unobatbayar

unobatbayar commented Aug 16, 2021

Copy link
Copy Markdown

@Fortuneod

Well, the firstname input is invisible thanks to the css, so an actual user won't be able see or fill it. Only way to fill it would be some sort of script so a spam script fills it as it sees it as an input. Therefore, it's a clever way to distinguish a person and a bot to prevent spam.

@Fortuneod

Copy link
Copy Markdown

@unobatbayar

Thanks for the response. I get it clearly now

@andrewlimaza

Copy link
Copy Markdown
Author

@wvlnsr, you'd add it to the same page as your form. It checks if there's been POST parameters and runs it through a check. If the firstname dummy field is filled it won't send the email to your address 👍

@mayishajiyev

Copy link
Copy Markdown

Thanks for the response. I

@Wifialarm

Copy link
Copy Markdown

That worked like a charm.
I used only few lines in my ready made web post form - honeypot field and check
And few lines in html part.
Now will look how many will overcome.
But these spambots are crazy - as soon as I put website online, I got one spam per 2 min. Disaster.

Thanks to you for code!

@Yasso2023

Yasso2023 commented Jan 18, 2023

Copy link
Copy Markdown

Hello all,
I am also struggling with spam and looking for a way to get this problem under control.

I have a question about the code, is this exactly as specified above inserted on the same page as text or is this inserted under Contact form 7 (additional settings).

do I need to customize the code other than the placeholder texts?

Sorry for my simple questions.
Thanks in advance :)

@irishgeoff20

Copy link
Copy Markdown

These are good tips. Can anyone suggest if its a good idea to use a form backend service to stop form spam?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment