# Honeypot Trap for Login and Registration Forms

> Adds an invisible field to the login and registration forms; bots that fill it in are rejected while people never see it.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, spam, honeypot
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/honeypot-login-registration/

## Code

```php
$wpide_hp_field = function () {
    echo '<p style="position:absolute;left:-10000px;width:1px;height:1px;overflow:hidden" aria-hidden="true">';
    echo '<label for="wpide_company_site">Company website</label>';
    echo '<input type="text" name="wpide_company_site" id="wpide_company_site" value="" tabindex="-1" autocomplete="off">';
    echo '</p>';
};

add_action( 'login_form', $wpide_hp_field );
add_action( 'register_form', $wpide_hp_field );

add_filter( 'authenticate', function ( $user ) {
    if ( 'wp-login.php' === ( isset( $GLOBALS['pagenow'] ) ? $GLOBALS['pagenow'] : '' ) && ! empty( $_POST['wpide_company_site'] ) ) {
        return new WP_Error( 'wpide_honeypot', '<strong>Error:</strong> Login failed.' );
    }

    return $user;
}, 1 );

add_filter( 'registration_errors', function ( $errors ) {
    if ( ! empty( $_POST['wpide_company_site'] ) ) {
        $errors->add( 'wpide_honeypot', '<strong>Error:</strong> Registration failed.' );
    }

    return $errors;
} );
```

## Notes

Password managers rarely fill hidden fields, but test your own login once after activating.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Honeypot Trap for Login and Registration Forms" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/