FINDINGsignup.
Jump to what to dosignup.honeypot_filled
The hidden honeypot field arrived with a value in it.
What it looks at#
You add a form field that real users never see (hidden with CSS, tabindex="-1",
autocomplete="off", a plausible name such as website) and send its value as honeypot.
This check fires when the value is not empty. Send "" when it was empty: the check then
runs and passes, instead of appearing in checks_skipped with reason input.
Why it matters#
Scripts that fill every input they find fill the honeypot too. People cannot, because they do not see it. It is about as close to proof of automation as one field gets.
What to do#
High severity, so the verdict is block. A small number of browser extensions autofill
hidden fields; if your audience uses them heavily, watch the rate before enforcing.