Honeypot field
Field name
bookmarkVisibility Hidden via CSS (visually-hidden + aria-hidden)
A non-empty value in this invisible field is a high-confidence bot signal.
Anti-Abuse
Active defenses against abuse — captcha, honeypot, rate limits, AI budget.
Min fill time
Minimum fill time
2000 msRenders timestamp injected at
load time, validated server-side on submitSubmissions faster than the minimum are silently rejected — same response shape as a successful submit.
Protected surfaces
- Public feedback form
src/routes/(public)/feedback/+page.server.ts
Auth flows use ALTCHA instead — honeypot covers unauthenticated form posts.
Think this pattern could be better? Tell us how.
Leave feedback