# Honeypot Trap on the Lost Password Form

> Adds a hidden field to the lost password form that only bots fill in and silently ignores those requests, so bots cannot flood your users with reset emails.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: login, password, honeypot
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/lost-password-honeypot/

## Code

```php
add_action( 'lostpassword_form', function () {
    echo '<p style="position:absolute;left:-9999px;" aria-hidden="true"><label>Company website <input type="text" name="wpide_lp_trap" value="" tabindex="-1" autocomplete="off"></label></p>';
} );

add_action( 'lostpassword_post', function ( $errors ) {
    if ( empty( $_POST['wpide_lp_trap'] ) ) {
        return;
    }

    wp_safe_redirect( add_query_arg( 'checkemail', 'confirm', wp_login_url() ) );
    exit;
} );
```

## Notes

Real users never see the field; bot requests get the normal "check your email" screen but no email is sent.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Honeypot Trap on the Lost Password Form" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/