Honeypot login form | 8 anti-spam strategies for 2025

What is a honeypot in the form?

How can I protect myself from a flood of spam?

This guide gives you all the basics.

Let’s get started!

What is a honeypot?

In the past, hunters used a honeypot to attract bears (dangers) and eliminate them. The digital world also offers dangers (criminals), which we pose with our digital honeypots. We only want to track down criminals and not customers based on behaviour or other characteristics with a honeypot. Computer science does not recognise the “one honeypot”. You can ask 10 computer scientists and they will show you 20 honeypot traps.

There are two types …

1. An anti-spam honeypot, which is designed to prevent spam.
2. A hacking honeypot pretends to be a software system that is protected with the default password. This is an easy target for criminals. Such a honeypot is suitable for understanding criminal behaviour and preparing for it.

Why do I need an anti-spam honeypot?

• Self-protection: You / the company do not want to read the same nasty spam e-mails 1000 times. But we also don’t want to miss that one email from a key customer.
• Protecting others: Forms often send a confirmation email to the specified address. Criminals exploit this mechanism to flood other email inboxes. Criminals can hack accounts and change passwords while the important warning to the customer gets lost in the flood of emails.
• Phishing: Even though most spam emails are easily recognisable, there are also super realistic, super dangerous emails from some criminals. A honeypot makes it harder for the criminals to slip you a phishing email.

TOP 6 strategy against spam

As already announced, there is no ONE strategy to prevent spam. The aim is to recognise criminal behaviour:

#1 Check syntax with regex

The simplest method is to check the content.

• Is the email syntax correct?
• Are all fields filled in?
• Are there at least 10 characters in the description?

A regular expression (regex) can check these formalities well. You can find out more about this topic here. If the syntax differs from what is expected, the software marks the message as spam.

#2 Check empty hidden fields

Another popular method is to hide text fields. A real person (usually) sees unhidden input fields and forgets to fill them in.

A robot on the other side recognises the input fields immediately because it looks at the code and not the surface. The software filters out all messages that have filled the hidden text field.

#3 Check filled fields

You can also reverse the previous method.

Fill fields with a default value or a value that is generated when the page is created. The backend, e.g. Laravel, checks the default value. Has it been changed? There are no limits to your creativity here (obfuscation): We can rename fields for robots – email is subject, text field is the house number. The main thing is that you don’t get confused and reorganise the fields correctly in the backend.

#4 Check plausibility

Spam filters often work with a keyword analysis. If, for example, the word gold, profit or discount appears 10 times, then the enquiry is not plausible enough. You can use keywords to filter out the usual suspects using a simple rule or with a neural network or a support vector machine.

In the same way, an enquiry is implausible if a Russian enquiry arrives via a German form – how is the Russian supposed to know what “Send” or “Cancel” means?

Are you sure?

You can also add form fields, e.g. type of enquiry, reference to a point in time in the video or audio.

#5 Check timer

Robots can send many requests per second to your inbox, while a normal human needs several minutes to formulate a relevant request.

A website can measure this time. The algorithm then sorts out which enquiry was “typed” in 0.01 seconds.

#6 Deviate from the standard

WordPress offers a variety of plugins. These add a form to your website.

Some of these plugins have millions of installations. It is precisely these forms that criminals target because they always work in the same way. If the criminal’s robot finds such a website, it immediately tries out its standard exploits.

Diverge from “the masses” by using your own form or making significant changes to known forms.

Prevent overloading – Antiflood

We can come up with great mechanisms, but this strategy won’t help against flooding attacks. The aim of a flooding attack is to overload the victim’s systems. Each computer is limited to X requests per second. If the server exceeds this number of requests, a real customer can no longer access the system.

The article on DDoS and bots describes the attack in detail. Honeypots are useless here, we have to block IPs, redirect the traffic or create a sinkhole.

Hacking honeypot

Hacking honeypots work differently to spam honeypots. Hacking honeypots are very easy to attack systems that are designed to act as a lure for criminals.

You also get the lodge position and monitor everything the criminal does with this honeypot. In contrast to the spam honeypot, you don’t want to prevent a hack, you want to promote it …

Why do I need a hacking honeypot?

• When a criminal taps into a honeypot, you can understand the criminal’s behaviour. What is he doing? What is their goal? What tools are they using? Good monitoring is the key here.
• If a honeypot is hacked on your internal network, then you know that the criminals are already on the network. You might want to check other systems to see if they’ve been hacked too.
• If you’re an interested IT guy who wants to waste criminals’ time and write cool stories about it.

How does this one work?

1. Honeypots run “preferably” on separate hardware. You can buy ready-made honeypots on the Internet (hardware with software) or download honeypot software from a Raspberry Pi.
2. Now you need a log server. You don’t just want the criminals to get in, you also want to see as much of the interactions as possible.
3. Make the honeypot visible in the network, assign the default password of the software or admin / admin. Prevent employees or other normal users in the network from getting the idea that the honeypot is a real service.
4. Check whether the logs reach your log servers as soon as you access the honeypot.
5. Block access to other servers and services that could be accessed from a honeypot. This is called lateral movement in the network. We should avoid this approach by criminals at all costs, but only avoid “damage” to the honeypot. If the criminals want to melt the CPU, then the low-cost hardware of the Raspberry Pi is a good option.