# Enable honeypot spam protection

> Add one hidden field that stops most spam bots, on top of Formclick’s built-in filtering.

Source: https://docs.formclick.io/help/honeypot-spam-protection

A honeypot is a field that people never see but bots fill in. When it has a value, Formclick quietly drops the submission. Bots still get a success response, so they don’t try again.

## Add it to your form

```html
<input type="checkbox" name="botcheck" class="fc-hp" tabindex="-1" autocomplete="off">

<style>
  .fc-hp { position: absolute; left: -9999px; width: 1px; height: 1px; overflow: hidden; }
</style>
```

Place it anywhere inside the `<form>`. All Formclick templates already include it.

## What else protects your form

- **Spam scoring:** messages with link spam or common spam phrases go to the **Spam** tab instead of your inbox.
- **Rate limits:** 5 submissions per form, per visitor, every 10 minutes.
- **Duplicate detection:** the same submission twice within 2 minutes is only saved once.
- **Captcha (paid plans):** add [reCAPTCHA](https://docs.formclick.io/html-forms/recaptcha) or [Cloudflare Turnstile](https://docs.formclick.io/html-forms/turnstile) for forms that attract bots.
- **Domain restriction (paid plans):** only accept submissions from [your own websites](https://docs.formclick.io/help/allowed-domains).

All of this is on for every form, on every plan. See [Spam protection](https://docs.formclick.io/html-forms/spam-protection).