# Honeypot fields catch bots

- **Pattern:** `ab-000708` (`community-moderation-safety.spam-prevention.honeypot`)
- **Severity:** low
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-000708
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-000708)

## Why it matters

Submission forms without honeypot fields let cheap bot scripts flood the platform with spam accounts, fake posts, comment payloads, and referral abuse at near-zero cost. That drives moderation backlog, pollutes search and recommendation surfaces, burns database rows and email quota, and erodes trust in user-generated content. Honeypots are a low-friction first filter that stops naive scrapers before they reach rate limiters or human moderators, complementing access-control defenses.

## Severity rationale

Low because honeypots are a soft defense; missing them increases spam volume but does not directly breach accounts or data.

## Remediation

Add a hidden decoy input to every public submission form with a plausible name like `website_url` or `company`, mark it `aria-hidden="true"` and `tabindex="-1"`, and reject requests server-side whenever the field is non-empty. Enforce the check in the route handler, not in client JS, so headless bots cannot bypass it.

```ts
// src/app/api/posts/route.ts
export async function POST(req: Request) {
  const body = await req.json();
  if (body.website_url) {
    return Response.json({ error: 'Spam detected' }, { status: 400 });
  }
  // ...continue processing
}
```

## Detection

- **ID:** `honeypot`
- **Severity:** `low`
- **What to look for:** Check if forms include hidden "honeypot" fields (decoy fields that bots fill but humans don't see). Verify submission is rejected if honeypot is filled.
- **Pass criteria:** Forms have at least 1 hidden honeypot field (a decoy input with `display:none` or `aria-hidden`). Submissions that fill the honeypot are rejected or logged server-side. Count all public submission forms and verify each includes a honeypot.
- **Fail criteria:** No honeypot fields used on any submission form. A honeypot that is checked only client-side does not count as pass.
- **Skip (N/A) when:** Platform has fewer than 100 active users or uses CAPTCHA on all submission forms as alternative bot prevention.
- **Detail on fail:** `"Forms have no honeypot fields. A simple bot script can submit content without CAPTCHA."`
- **Remediation:** Add hidden honeypot fields to forms. Server-side validation at `src/api/posts/route.ts`:

  ```javascript
  // Reject if honeypot field is filled (bots fill hidden fields)
  if (req.body.website_url) { // hidden field named to attract bots
    return res.status(400).json({ error: 'Spam detected' });
  }
  ```

## External references

- owasp A04

Taxons: access-control

HTML version: https://auditbuffet.com/patterns/ab-000708