Honeypot Protection

An optional extra layer against simple spam bots.

Heads up: bots are getting smarter, and some skip hidden fields. Use a honeypot as an extra layer next to Cloudflare Turnstile or reCAPTCHA.

What is a honeypot?

A honeypot is a hidden field that people never fill in. If it has a value, Formbold marks the submission as spam. It's free on every plan and off by default.

How do I set it up?

1. Open your form and go to the Settings tab.
2. Under Spam & Security, switch on Honeypot Protection.
3. Add the hidden field to your form, as in the example below.

Example

Replace FORM_ID with your form ID. Keep the name _gotcha and don't add a label.

<form action="https://formbold.com/s/FORM_ID" method="POST">
  <label for="name">Name</label>
  <input type="text" id="name" name="name" required />

  <label for="email">Email</label>
  <input type="email" id="email" name="email" required />

  <label for="message">Message</label>
  <textarea id="message" name="message" required></textarea>

  <!-- Honeypot -->
  <input type="text" name="_gotcha" tabindex="-1" autocomplete="off"
    aria-hidden="true"
    style="position:absolute;left:-9999px;opacity:0;height:0;width:0">

  <button type="submit">Send</button>
</form>

What happens when a bot is caught?

• Saved as spam. It goes to the Spam folder in Submissions.
• Nothing is sent. No email, auto-responder or integration runs, and it doesn't count toward your plan's limit.
• The bot sees success. It gets a normal success message.

Note: Test submissions from the dashboard skip spam checks, so they won't trigger the honeypot.

Troubleshooting

• Autofill filled in the hidden field. Keep autocomplete="off" and the off-screen style as shown.
• Another field on your form is also named _gotcha.
• The hidden field has a label or a normal-looking name.