Honeypot Trap for Login and Registration Forms
Adds an invisible field to the login and registration forms; bots that fill it in are rejected while people never see it.
Opens WPIDE on
Code
$wpide_hp_field = function () {
echo '<p style="position:absolute;left:-10000px;width:1px;height:1px;overflow:hidden" aria-hidden="true">';
echo '<label for="wpide_company_site">Company website</label>';
echo '<input type="text" name="wpide_company_site" id="wpide_company_site" value="" tabindex="-1" autocomplete="off">';
echo '</p>';
};
add_action( 'login_form', $wpide_hp_field );
add_action( 'register_form', $wpide_hp_field );
add_filter( 'authenticate', function ( $user ) {
if ( 'wp-login.php' === ( isset( $GLOBALS['pagenow'] ) ? $GLOBALS['pagenow'] : '' ) && ! empty( $_POST['wpide_company_site'] ) ) {
return new WP_Error( 'wpide_honeypot', '<strong>Error:</strong> Login failed.' );
}
return $user;
}, 1 );
add_filter( 'registration_errors', function ( $errors ) {
if ( ! empty( $_POST['wpide_company_site'] ) ) {
$errors->add( 'wpide_honeypot', '<strong>Error:</strong> Registration failed.' );
}
return $errors;
} );Notes
Password managers rarely fill hidden fields, but test your own login once after activating.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.