Skip to content

Instantly share code, notes, and snippets.

@andrewlimaza
Last active July 17, 2024 07:03
Show Gist options
  • Save andrewlimaza/958826feac907114a57462bfc8d535ff to your computer and use it in GitHub Desktop.
Save andrewlimaza/958826feac907114a57462bfc8d535ff to your computer and use it in GitHub Desktop.
Simple honeypot for an HTML form using PHP
<?php
//check if form was sent
if($_POST){
$to = 'some@email.com';
$subject = 'Testing HoneyPot';
$header = "From: $name <$name>";
$name = $_POST['name'];
$email = $_POST['email'];
$message = $_POST['message'];
//honey pot field
$honeypot = $_POST['firstname'];
//check if the honeypot field is filled out. If not, send a mail.
if( ! empty( $honeypot ) ){
return; //you may add code here to echo an error etc.
}else{
mail( $to, $subject, $message, $header );
}
}
?>
<html>
<head>
<title>HoneyPot for HTML Form Example</title>
<style>
.hide-robot{
display:none;
}
</style>
</head>
<body>
<form method="post" action="#my-form" id="my-form">
<!-- Create fields for the honeypot -->
<input name="firstname" type="text" id="firstname" class="hide-robot">
<!-- honeypot fields end -->
<input name="name" type="text" id="name" placeholder="Name" required><br>
<input name="email" type="email" id="email" placeholder="Email" required><br>
<textarea name="message" id="message" placeholder="Enter your message here" required></textarea><br>
<input type="submit">
</form>
</body>
</html>
@vortex100
Copy link

vortex100 commented Feb 27, 2021

Many bots are now onto the "display: none" style or any style with the words "hidden" or "hide" in the name. Instead, use the following style to hide your input field:
.myblank {
opacity: 0;
position: absolute;
top: 0;
left: 0;
height: 0;
width: 0;
z-index: -1;
}

@NjRis
Copy link

NjRis commented Jun 30, 2021

Hi ! The php part didn't get reconigze in my code

@unobatbayar
Copy link

unobatbayar commented Aug 12, 2021

Brilliant.

Small performance improvement, probably indifferent in this case but in it might help if you have huge code.

Checking the return case early

Example:

if($_POST){
	//check if the honeypot field is filled out. If not, send a mail.
	$honeypot = $_POST['firstname'];
	if(!empty( $honeypot )) return;

        //proceed to send mail
	$to = 'some@email.com';
	$subject = 'Testing HoneyPot';
	$header = "From: $name <$name>";

	$name = $_POST['name'];
	$email = $_POST['email'];
	$message = $_POST['message'];

        mail( $to, $subject, $message, $header );
}

@Fortuneod
Copy link

Now, I am trying to get the whole idea of this. How does the firstname input work as the honeypot field?

@unobatbayar
Copy link

unobatbayar commented Aug 16, 2021

@Fortuneod

Well, the firstname input is invisible thanks to the css, so an actual user won't be able see or fill it. Only way to fill it would be some sort of script so a spam script fills it as it sees it as an input. Therefore, it's a clever way to distinguish a person and a bot to prevent spam.

@Fortuneod
Copy link

@unobatbayar

Thanks for the response. I get it clearly now

@andrewlimaza
Copy link
Author

@wvlnsr, you'd add it to the same page as your form. It checks if there's been POST parameters and runs it through a check. If the firstname dummy field is filled it won't send the email to your address 👍

@haciyevmayis
Copy link

Thanks for the response. I

@Wifialarm
Copy link

That worked like a charm.
I used only few lines in my ready made web post form - honeypot field and check
And few lines in html part.
Now will look how many will overcome.
But these spambots are crazy - as soon as I put website online, I got one spam per 2 min. Disaster.

Thanks to you for code!

@Yasso2023
Copy link

Yasso2023 commented Jan 18, 2023

Hello all,
I am also struggling with spam and looking for a way to get this problem under control.

I have a question about the code, is this exactly as specified above inserted on the same page as text or is this inserted under Contact form 7 (additional settings).

do I need to customize the code other than the placeholder texts?

Sorry for my simple questions.
Thanks in advance :)

@irishgeoff20
Copy link

These are good tips. Can anyone suggest if its a good idea to use a form backend service to stop form spam?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment