A honeypot trap is a hidden link or form field on a webpage, invisible to real human visitors but detectable by automated scrapers that parse raw HTML, designed to identify and flag bot traffic. Any request that interacts with the honeypot element reveals itself as automated, since no real user would ever click or fill in something they can't see.

Honeypots are typically implemented with CSS (display: none or positioning off-screen) so they never render visibly in a browser, while still existing in the page's HTML for a scraper to find if it isn't filtering for visibility. Well-built scrapers avoid this by checking element visibility before interacting with links or forms, rather than blindly following every link or filling every input found in the raw markup.

Some honeypot implementations go further than a hidden link, using a hidden form field with a plausible-sounding name, like "website" or "company", specifically to catch scripts that fill in every form field indiscriminately.

Honeypots work because they exploit exactly what makes an automated web crawler efficient: it follows and fills in everything it finds, where a human visitor would simply never see the trap.