Honeypot Trap

A hyperlink styled with display: none or visibility: hidden via CSS, or positioned off-screen using absolute coordinates. Human users navigating with a mouse or touchscreen will never see or click this link. However, a parser extracting all href attributes from the DOM will discover and follow it. Accessing the decoy URL is a definitive indicator of non-human traffic.

• CSS Techniques: display: none, visibility: hidden, opacity: 0, or position: absolute; left: -9999px.
• Placement: Often embedded in the footer or navigation menus to blend with legitimate site structure.
• Response: The target URL returns a 403 Forbidden status and immediately flags the source IP.

An input field added to forms that is visually concealed from users via CSS. Legitimate users filling out the form in a browser will leave this field blank. Automated scripts that parse HTML and populate all input fields programmatically will inject a value. Any submission containing data in this hidden field is rejected as bot-originated spam.

• Common Names: Fields labeled url, website, email_confirm, or fax exploit bots' tendency to auto-fill common field names.
• Tabindex Removal: Setting tabindex="-1" prevents keyboard-navigating users from accidentally focusing the field.
• Autocomplete Disable: Adding autocomplete="off" prevents legitimate browser autofill from triggering a false positive.

A unique, session-specific token is embedded within an HTML comment, a meta tag, or a data attribute that is invisible during normal rendering. When a scraper blindly extracts and transmits the full page source or structured data, the token is included. Server-side validation detects the leaked token, proving the content was accessed programmatically rather than consumed through a standard browser viewport.

• Implementation: <meta name="trap" content="{{unique_session_token}}"> or <!-- trap: {{token}} -->.
• Validation: The server checks incoming API payloads or form submissions for the presence of the token.
• Advantage: Does not rely on the bot interacting with a specific element; passive extraction is sufficient for detection.

A dedicated URL path is advertised in robots.txt with a Disallow directive, explicitly instructing compliant crawlers to avoid it. Malicious or aggressive scrapers often intentionally target disallowed paths as a first-pass strategy to find hidden or sensitive content. Any traffic to this endpoint is unambiguously hostile. The server applies an instantaneous, aggressive rate limit or a tarpit response to slow the attacker to a crawl.

• robots.txt Entry: Disallow: /private/debug/
• Tarpit Response: The server responds with 1 byte per second, consuming the scraper's connection pool without providing useful data.
• Signal Value: Zero false positives, as no legitimate user or compliant bot will request a disallowed path.

Fabricated, unique data records—such as fake email addresses, API keys, or user profiles—are inserted into a database or content repository. These records have no legitimate business purpose. If a honeytoken email address ever receives a message, or a fake API key is used in a request, it proves a data breach or unauthorized data extraction has occurred. This technique detects exfiltration after it happens.

• Canary Values: AWS-style account IDs or credit card numbers that trigger alerts when used.
• Embedding: Placed in JSON responses, hidden HTML, or database tables accessible only via authenticated API calls.
• Alerting: Any interaction with a honeytoken triggers an immediate security incident response.

A transparent overlay or a z-index stacking trick places a decoy element directly on top of a legitimate button or link. A human user sees and clicks the visible element underneath. A headless browser parsing the DOM tree without computing visual stacking contexts will interact with the transparent trap element on top. This technique specifically targets unsophisticated headless browsers that do not execute full layout rendering.

• Implementation: A div with opacity: 0 and z-index: 999 positioned absolutely over a 'Submit' button.
• Detection Logic: Clicks registered on the invisible overlay indicate a bot.
• Limitation: Advanced headless browsers using Puppeteer or Playwright with full layout rendering will pass this test.