Will accessibility tools expose the honeypot?

Use aria-hidden and tabindex=-1. Do not use display:none if you test with strict bots-only rules—off-screen is common.

Must the name match MuxForms?

Yes. The dashboard honeypot field name must match what you send in JSON or embed.

Pair with rate limits; add Turnstile when traffic spikes. See the spam protection guide.

This honeypot snippet generator outputs CSS to hide a decoy input, accessible HTML, MuxForms field JSON, and a sample fetch body so bots fill the trap and humans never see it.

Tool

Honeypot generator

Name your field, pick a hide style, copy into your form or schema.

Field nameLabel (shown in HTML only)Hide technique

CSS

.mux-honeypot {
  position: absolute;
  left: -9999px;
  width: 1px;
  height: 1px;
  overflow: hidden;
}

HTML

<label class="mux-honeypot" aria-hidden="true">
  Leave this field empty
  <input type="text" name="_hp" tabindex="-1" autocomplete="off" />
</label>

MuxForms field JSON

{
  "name": "_hp",
  "label": "Leave blank",
  "type": "hidden",
  "hidden": true
}

fetch / JSON body

// Include in JSON body; bots often fill every input.
{
  "_hp": ""
}

MuxForms silently drops submissions when the honeypot field is filled. Match the field name in your dashboard schema. See spam protection guide.

Spam protection guide · HTML form generator

Common questions

Will accessibility tools expose the honeypot?: Use aria-hidden and tabindex=-1. Do not use display:none if you test with strict bots-only rules—off-screen is common.
Must the name match MuxForms?: Yes. The dashboard honeypot field name must match what you send in JSON or embed.
Enough on its own?: Pair with rate limits; add Turnstile when traffic spikes. See the spam protection guide.

Bots hate empty fields.

Humans never see the honeypot; your inbox stays cleaner.

Upgrade to Pro