🍯 Honeypot Form Field

A hidden form field that people never see and automation fills in.

→ Explore in ATT&CK matrix (1 mappings) Deployment detail

What it is

Add a form input hidden from people (not displayed, labelled 'leave blank'). Humans never fill it; bots that complete every field do. Any submission with the field filled is automation, including automation that has solved or sidestepped a CAPTCHA.

Implementation requirements

A hidden input with a plausible name on login, sign-up and contact forms
Server-side check: flag or reject submissions where it is filled, and log the source and session
Rotate field names; sophisticated bots learn to skip known honeypot fields
Accessibility: hide it from screen readers too, so no person fills it by accident
Rollback: Remove the hidden field and its server-side check.
Upkeep: Check after form redesigns that the field is still hidden from people, including screen-reader users. Review submissions it flags for false positives.

Cost

Negligible.

Indicative only. Cloud pricing and licensing change — check the provider's official pricing pages for current rates before you budget.

Technologies

Application

ATT&CK coverage 1

Technique	Tactic	Status	Confidence	Tier
T1696 Anti-Automation Evasion	Stealth	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Bot Management and Anti-Automation Cheat Sheet — Documents hidden honeypot form fields as an anti-automation control: bots fill them, humans do not. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1696 Anti-Automation Evasion as an adversary behaviour. Sophisticated bots learn to skip known honeypot fields; rotate names.

Evidence

Bot Management and Anti-Automation Cheat Sheet — OWASP standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: The OWASP Bot Management and Anti-Automation Cheat Sheet documents hidden honeypot form fields: bots fill them, humans do not.