Honeypot Fields

A honeypot field is a hidden input that legitimate users never fill, but basic bots often do. You can use this technique with Formbase by adding a hidden field and checking it in your UI or processing pipeline. Formbase does not block honeypots automatically, so you should decide how to handle flagged submissions.

Add a hidden field

<form action="https://formbase.dev/s/YOUR_FORM_ID" method="POST">
  <input name="name" type="text" required />
  <input name="email" type="email" required />

  <div style="position:absolute; left:-10000px;" aria-hidden="true">
    <label for="company">Company</label>
    <input id="company" name="company" type="text" tabindex="-1" autocomplete="off" />
  </div>

  <button type="submit">Send</button>
</form>

Real users never see or fill the hidden field.

Handle flagged submissions

If the honeypot field has a value, treat the submission as spam in your workflow or remove it from the dashboard.

For stronger protection, combine honeypots with CAPTCHA or rate limiting at the edge.

Spam Protection CORS Policies

⌘I

Getting Started

Integrations

File Uploads

Form Settings

Redirects

Submissions

Security

Self-Hosting

CMS Platforms

FAQ