Honeypot fields catch bots

Submission forms without honeypot fields let cheap bot scripts flood the platform with spam accounts, fake posts, comment payloads, and referral abuse at near-zero cost. That drives moderation backlog, pollutes search and recommendation surfaces, burns database rows and email quota, and erodes trust in user-generated content. Honeypots are a low-friction first filter that stops naive scrapers before they reach rate limiters or human moderators, complementing access-control defenses.

Add a hidden decoy input to every public submission form with a plausible name like website_url or company, mark it aria-hidden="true" and tabindex="-1", and reject requests server-side whenever the field is non-empty. Enforce the check in the route handler, not in client JS, so headless bots cannot bypass it.

// src/app/api/posts/route.ts
export async function POST(req: Request) {
  const body = await req.json();
  if (body.website_url) {
    return Response.json({ error: 'Spam detected' }, { status: 400 });
  }
  // ...continue processing
}