Mailbag Contact FormHow a contact form honeypot works in WordPress
A honeypot is an extra field that people never see and bots fill in. If it has a value, the message came from a bot. Done well, it stops a large share of automated spam with no effect on visitors — but only if bots can't recognise it and real browsers don't fill it in by accident.
What makes a honeypot work
- An unpredictable name and label. If the honeypot is always called
websiteor always sits in the same position, bots written for that plugin skip it. - Hidden from people, including screen reader users. Visually hidden isn't enough: the wrapper needs
aria-hidden="true", and the field must be out of the tab order withtabindex="-1". - Ignored by autofill. Browsers and password managers fill in fields that look like addresses or names;
autocomplete="off"and a label that doesn't look like a real field avoid false alarms.
What to do with a caught message
Throwing it away silently is tempting, but any check can misfire. Keeping caught messages somewhere you can look lets you rescue the rare real one. Showing the bot the same thank-you message as a person gives it no signal to adapt to.
Mailbag's honeypot
Mailbag Contact Form adds a honeypot to every form, and it's always on. Its label is random rather than a fixed word, the wrapper is hidden from assistive technology, and the field is out of the tab order with autofill off — a keyboard or screen reader user never meets it.
A message with the honeypot filled in is saved as spam with the reason honeypot, no notification is emailed, and the visitor sees the normal thank-you. It stays under Spam in Entries for 30 days, at most 1,000 entries.
Not enough on its own
A honeypot catches bots that fill every field. It works best alongside a time trap and a limit per address, which Mailbag also runs — see spam without a CAPTCHA.
Mailbag Contact Form is a free contact form that saves every entry before it sends anything, and shows you what happened to each email.
See what it does