Simple HTML Form bot detection

Feb 12, 2025

I recently had to integrate a contact form on a homepage, which naturally attracted a few bots after a very short time. Since I don’t want to use reCAPTCHA for reasons and I don’t like all the other external solutions, I came up with the following solution:

HTML:

<form action="/cgi-bin/mail" method="POST">
    <input type="text" name="name" placeholder="Name" required>
    <input type="textarea" name="message" placeholder="Message" required>
    <input type="text" name="botcatcher" id="botcatcher"> <!-- This is NOT required -->
    <input type="submit">
</form>

CSS:

form {
    input[name=botcatcher] {
        display: none;
    }
}

JavaScript:

document.getElementById("botcatcher").value="imnotabot";

As bots are usually script-based and do not parse JavaScript, this field should only be filled if a visitor submits the form with JavaScript enabled. I know that there are also people out there who have JavaScript disabled in their browser, so a manual check of the messages is still necessary. So far, however, the detection rate is over 99%, so this is almost negligible.

Back…