Honeypot Captcha

The simplest way to add honeypot captchas in your Rails forms.

Honeypot captchas work off the premise that you can present different form fields to a spam bot than you do to a real user. Spam bots will typically try to fill all fields in a form and will not take into account CSS styles.

We add bogus fields to a form and then check to see if those fields are submitted with values. If they are, we assume that we encountered a spam bot.

• Honeypot Captcha by Phil Haack
• Stopping spambots with hashes and honeypots

• Rails >= 2.3.8

In your Gemfile, simply add

gem 'honeypot-captcha'

I've tried to make it pretty simple to add a honeypot captcha, but I'm open to any suggestions you may have. By default, create and update actions are protected. For other actions, see below.

Simply specify that the form has a honeypot in the HTML options hash:

<%= form_for Comment.new, :html => { :honeypot => true } do |form| -%>
  ...
<% end -%>

Simply specify that the form has a honeypot in the options hash:

<%= form_tag comments_path, :honeypot => true do -%>
  ...
<% end -%>

Simply specify that the form has a honeypot in the options hash:

<%= form_tag comments_path, :honeypot => true -%>
  ...
</form>

Simply specify that the form has a honeypot in the HTML options hash:

<%= simple_form_for Comment.new, :html => { :honeypot => true } do |form| -%>
  ...
<% end -%>

If you are submitting a form to a non-RESTful action and require honeypot protection, simply add the before filter for that action in your controller. For example:

class NewsletterController < ApplicationController
  prepend_before_action :protect_from_spam, :only => [:subscribe]
  ...
end

Override the honeypot_fields method within ApplicationController to add your own custom field names and values. For example:

def honeypot_fields
  {
    :my_custom_comment_body => 'Do not fill in this field, sucka!',
    :another_thingy => 'Really... do not fill out!'
  }
end

NOTE: honeypot_fields hash keys are used at the beginning of the generated HTML id attributes. The HTML 4.01 spec states that ids must start with a letter ([A-Za-z]), so be aware of this when creating the hash keys. HTML5 is much less strict.

Override the honeypot_string method within ApplicationController to disguise the string that will be included in the honeypot name. For example:

def honeypot_string
  'im-not-a-honeypot-at-all'
end

Override the honeypot_style_class method within ApplicationController to provide a non-inline CSS class that will be applied to hide honeypot fields (if nil, the style will be applied inline). For example:

def honeypot_style_class
  'display-none'
end

... assigns an HTML class for styling purposes:

<div id="login_hp_1464171481" class="display-none">

... which can be styled by a CSS style within app/assets/stylesheets:

.display-none {
  display: none;
}

• Fork the project.
• Make your feature addition or bug fix.
• Add tests for it. This is important so I don't break it in a future version unintentionally.
• Commit, do not mess with rakefile, version, or history. (if you want to have your own version, that is fine but bump version in a commit by itself I can ignore when I pull)
• Send me a pull request. Bonus points for topic branches.

Created by Curtis Miller of Velocity Labs, a Ruby on Rails development company.

• Dave Tapley

Thank you to all contributors!

• Eric Saxby
• Bernard Grymonpon
• rchekaluk
• Sunny Ripert
• RandieM
• Wayne Steven See

Copyright (c) 2010-2019 Curtis Miller. See LICENSE for details.