Honeypot

A honeypot is a form field that is invisible to human visitors but present in the markup, placed there purely as a trap. Real people never see it, so they never fill it in. Spam bots, which typically fill every field they find, do. Any submission that arrives with a value in the honeypot is, with high confidence, not from a person.

The appeal is friction: a honeypot costs legitimate visitors nothing. There is no puzzle to solve, no checkbox to tick, no image grid of traffic lights. It runs silently and catches the large population of unsophisticated bots that submit forms blindly.

The field is usually hidden by moving it off-screen with CSS rather than using type="hidden", since many bots skip hidden inputs. Adding tabindex="-1" and autocomplete="off" keeps keyboard users and browser autofill from tripping it. A honeypot is one layer, not a complete defense - sophisticated bots avoid them, which is why it belongs alongside rate limits and content checks.

SheetLink Forms uses a honeypot field named _slhp. If you use the sl.js embed, it is injected automatically; in a hand-written form you add it yourself:

<input name="_slhp" tabindex="-1" autocomplete="off" style="position:absolute;left:-9999px">

The honeypot has a distinctive role in the spam pipeline: it is the only signal that marks a submission as spam outright. Everything else - rate limits, content heuristics, the timing signal - routes suspicious submissions to quarantine for one-click review instead. The full layered model is described on the security page, with field details in the docs.