# Honeypot

Add a honeypot field to catch simple bots. Form Plume discards submissions that fill the hidden _gotcha input and returns a normal success response.

Many bots fill every input they can find. A honeypot gives them one field that people never use.

Add `_gotcha` to your form and leave it empty:

```html
<div hidden>
  <label>
    Leave this field empty
    <input type="text" name="_gotcha" tabindex="-1" autocomplete="off">
  </label>
</div>
```

If the field arrives with a value, Form Plume returns a normal-looking success response to the bot but does not store the submission or send notifications.

## Keep it invisible to people

Do not use `type="hidden"`. Basic bots understand hidden inputs. Hide a normal input from the layout and keyboard instead.

A honeypot has no [challenge](/docs/spam-protection/captcha) and no third-party script. It is a good default, but it should be one layer of your [spam protection](/docs/spam-protection) rather than the only one.