Honeypot Trap on the Lost Password Form
Adds a hidden field to the lost password form that only bots fill in and silently ignores those requests, so bots cannot flood your users with reset emails.
Opens WPIDE on
Code
add_action( 'lostpassword_form', function () {
echo '<p style="position:absolute;left:-9999px;" aria-hidden="true"><label>Company website <input type="text" name="wpide_lp_trap" value="" tabindex="-1" autocomplete="off"></label></p>';
} );
add_action( 'lostpassword_post', function ( $errors ) {
if ( empty( $_POST['wpide_lp_trap'] ) ) {
return;
}
wp_safe_redirect( add_query_arg( 'checkemail', 'confirm', wp_login_url() ) );
exit;
} );Notes
Real users never see the field; bot requests get the normal "check your email" screen but no email is sent.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.