Drupal Honeypot Module Documentation

This documentation explains how to install, configure, and test the Honeypot module in a Drupal site to protect forms from spam bots using hidden fields and time-based submission validation.

📦 Installation and Enabling with Composer and Drush

Step 1: Require the Module with Composer

composer require drupal/honeypot

Step 2: Enable the Module Using Drush

drush en honeypot -y

drush pm:list | grep honeypot

⚙️ Basic Configuration

1. Navigate to /admin/config/people/honeypot.
2. Enable Protect all forms.
3. Set Minimum time to e.g., 5 seconds.
4. Optionally enable Log blocked form submissions.
5. Save configuration.

🧾 Enabling Honeypot for Webforms

1. Go to /admin/structure/webform/config.
2. Scroll to Form settings.
3. Enable Honeypot checkbox.
4. Optionally configure Time limit and Element name.
5. Save configuration.

🔐 Permissions

Admins with bypass honeypot protection permission are not affected.

For testing: Use a logged-out or non-admin account.

✅ Confirming Honeypot is Applied

1. View the form as an anonymous user.
2. Use browser dev tools (F12) to inspect the form.
3. Look for:
   • A hidden honeypot_time field
   • A hidden honeypot text input (e.g., url)

🧪 Testing Honeypot Blocking

🔍 Test 1: Hidden Field Trigger

1. Open a form as an anonymous user.
2. Use developer tools to locate the honeypot field.

3. Modify it:

   <input type="text" name="url" value="spamtest" />

4. Wait the minimum time (e.g., 5 sec).
5. Submit the form.
6. Expect: Form is blocked; check logs if enabled.

⏱️ Test 2: Minimum Time Trigger

1. Load the form and immediately submit within 1-2 seconds.
2. Do not fill in the honeypot field.
3. Expect: Submission blocked due to time restriction.

Using cURL:

curl -X POST https://example.com/form-path \
  -d "honeypot_time=1" \
  -d "field_name=value"

🧯 Troubleshooting Steps

• ✅ Ensure Honeypot is enabled: drush pm:list | grep honeypot
• 🔧 Check config at /admin/config/people/honeypot
• 👤 Test with an anonymous user
• 📝 Enable logging for blocked submissions
• ⚠️ Look for conflicts with CAPTCHA/Webform Protect
• 🧹 Run drush cr to clear cache

🛠️ Configuration Reference Table

✅ Example Recommended Configuration

⚙️ Advanced Usage Notes

• 🔁 Change the honeypot field name to something non-standard (e.g., contact_token) to evade bots targeting defaults.
• 🧪 Temporarily enable logging to troubleshoot spam problems in /admin/reports/dblog.
• ⚠️ Disable “Protect all forms” if you want to configure Honeypot only on specific content types or forms.

📌 Summary

• 📦 Install Honeypot via Composer and Drush
• ⚙️ Configure globally or per-form
• 🧪 Test protection: hidden field and timing
• 🛠️ Log and monitor blocked attempts
• ✅ Use recommended defaults and test with anonymous users