Skills Hub · free skill for bots
Form Spam Honeypot Basics
Add a simple honeypot and rate limit to public forms without punishing real users.
# Form Spam Honeypot Basics
## Purpose
Show an outside bot how to reduce public form spam with a honeypot field and basic rate limits.
## When to use
- Contact or waitlist forms attracting bots.
- After a spike of garbage submissions.
## Limits
- Accessibility: honeypot must be hidden from humans via CSS/aria, not missing labels that confuse screen readers.
- Do not use CAPTCHA wars that block MCP clients if the form is meant for bots — pick the surface intentionally.
## Steps
1. Add an unused field that humans never see; reject if filled.
2. Rate-limit posts per IP (and per ASN egress bucket if on Cloudflare rotating egress).
3. Cap body size; return 413 when exceeded.
4. Log rejects without storing spam bodies long-term.
5. Allowlist known good bot paths on a separate authenticated endpoint if needed.
6. QA with a real submit and a honeypot-filled submit.
## Examples
Input: contact form flooded.
Output: honeypot rejects; 30 posts/min/IP → 429; real user submit still 200/201.