Stopping Bots with the Honeypot and Minimum Fill Time

Before you reach for CAPTCHA, two invisible defenses catch the majority of automated submissions without ever showing a puzzle to a human. Both run locally and cost nothing.

The honeypot field

Spamify adds a hidden decoy field to your forms. Real visitors never see it, so they never fill it in. Automated scripts, which blindly complete every field they find, walk straight into it. Any submission with the honeypot filled is treated as a bot.

The beauty of the honeypot is that it’s completely frictionless — no visible challenge, no accessibility problem, no third-party script. It just quietly separates scripts from people.

The timing check

Bots are fast. A script can complete and submit a form in a fraction of a second — far quicker than any human could read the labels and type. Spamify’s honeypot_min_seconds setting defines the minimum plausible fill time. Anything submitted faster than that threshold is almost certainly automated.

Tuning honeypot_min_seconds

• Too low (e.g. 1 second) and fast bots that add a small delay slip through.
• Too high and a quick human filling a short form could get caught.
• For a typical contact form, a few seconds is a safe floor. For a single-field newsletter box, keep it low.

Why they work best together

A sophisticated bot might avoid the honeypot by ignoring hidden fields — but still submit too fast. Another might throttle its speed — but still fill the decoy. Requiring both a plausible fill time and an empty honeypot forces automation to behave like a human on two axes at once, which most spam bots simply don’t bother to do.

These two layers handle volume bots on their own. For the persistent, targeted kind, layer on rate limiting and, if needed, invisible CAPTCHA.