Honeypot fails to block SPAM

Thanksgiving. Black Friday. Cyber Monday. Are you guys all on holiday?

Hi @greyowl, I don’t fully follow your message. What do you mean you “output the customer-entered content of the fields” — do you mean “input” values into the form? What are empty? The honeypot fields should be empty, and the expected result would be the form would send if they’re empty.

I checked your URL and the form seems to be rendering properly.

As for the time to response, please keep in mind that this is an entirely free plugin and unpaid support. It’s offered as-is and as-available.

Thanks for taking me seriously, Ryan.
My Contact 7 form is as follows:

<label> Ihr Name* [text* your-name] </label>
<label> E-Mail-Adresse* [email* your-email ] </label>
[honeypot Date]
<label> Betreff* [text* your-subject ]</label>
[honeypot Time]
<label> Ihre Nachricht* [textarea* your-message ]</label>
<label>[submit “Senden”]</p>

This form generates an email. In the Message Body I have the following:

[your-message]
Spamschutz: [_remote_ip], [Date], [Time]

The SPAM message I receive contains the line:

Spamschutz: 185.210.219.168, ,

This shows the two honeypot fields ([Date], [Time]) were indeed empty (i.e. not filled in by the bot). In that case I expected the message to be rejected as SPAM and not delivered. But it was delivered.
That’s my problem.

Thanks for the more thorough explanation. I think you’ve misunderstood how a honeypot field works. The field must be empty for the form to submit. The spam message is being delivered because the spammer/bot/tester is not filling in the honeypot fields. A honeypot has to trick the bot into filling out those fields, while a regular user wont fill them out because they can’t see them.

This is basically the opposite of how a captcha or math “prove you’re human” field works, which forces the user to enter the correct value into a field for the field to validate, in the hopes the bot will not be able to enter the correct value. Honeypots work on the presumption a bot will try to fill in as many fields as possible.

Thanks. I now see my misunderstanding. Should I put the honeypot field before the first valid field then? Is there any way to see which/how many spam messages are rejected?

It shouldn’t matter where the honeypot field is placed in the form. Typically I recommend naming it something that would be more likely to attract bots — i.e. “email” or “website” — something that a bot is likely to want to fill out.

There is no logging/tracking system in place, as the plugin simply uses CF7’s built in validation system. It’s an interesting feature idea though. I’ll make note to investigate it further for the next version.