Honeypot
AdvancedA trap laid for bots — invisible links, hidden form fields, or decoy systems that no human would touch, so touching them is a confession.
In depth
A honeypot is bait: a resource deliberately planted where no legitimate visitor would interact with it, so any interaction identifies an automated or malicious actor with near-zero false positives. The elegance is in the logic — the trap doesn't need to analyze you; your own behavior testifies.
Honeypots in web defense
- Invisible links: anchors hidden by CSS (
display:none, zero-size, off-screen) that no human can see or click. A crawler that follows every href in the DOM walks straight into them and gets its IP and fingerprint flagged. - Hidden form fields: an input invisible to humans but present in the markup; autofill bots complete it, and any submission with that field populated is discarded as bot traffic. A classic, cheap anti-spam layer.
- Decoy data and endpoints: fake API routes, trap email addresses embedded in pages (spamtraps that feed blacklists), and planted records that reveal when a dataset has been scraped and reused.
Beyond the web
Security teams run entire honeypot systems — fake servers, credentials, and networks — to detect intruders and study attack tooling. The unifying principle is identical: legitimate activity has no reason to touch the bait, so every touch is signal.
For scraper authors
Don't blindly follow every link or fill every field. Skip elements that are hidden, zero-sized, or visually undetectable — parsing the DOM like a human sees it is honeypot immunity, and headless browsers make visibility checks straightforward.
Examples
- A crawler follows a CSS-hidden link and its IP is instantly added to the site's blocklist.
- A signup form silently rejects any submission whose invisible 'website' field is filled — only bots fill it.
- A security team's decoy server records an intruder's tools and methods without exposing real systems.
Common use cases
FAQs
By evaluating visibility before interacting: skip links and fields that are display:none, zero-sized, off-screen, or transparent. Rendering pages in a real browser and operating only on human-visible elements provides the same immunity a human has.
Yes — a site owner planting traps on their own property is standard defensive practice, and enterprise honeypot platforms are a mature security industry. The legal caution runs toward entrapment-adjacent misuse, not ordinary bot traps.
Because they invert the detection problem. Instead of statistically inferring bot-ness from noisy signals, the trap creates a binary event no legitimate user can trigger — interaction is a confession, with essentially no false positives.