We tried catching bot traffic with a honeypot — can we trust the results and what should we do next?

If you hid elements using just display: none or visibility: hidden, modern bots simply parse the stylesheet, figure it out, and skip them. That leaves you catching only very primitive bots or accessibility tools. Pushing the hidden field off-screen (via text-indent or absolute positioning) and adding an aria-hidden attribute will significantly cut down on false positives.

We set up a similar honeypot last year. When we reviewed the first 800 captured IPs one by one, 120 turned out to be shared corporate egress IPs from our biggest wholesale clients. If we'd done a blanket ban that day, we would've completely cut off our top three ordering dealers.

edit: typed from phone, sorry for typos.

Honeypots alone don't stop modern scrapers anymore. Commercial price-scraping tools run full headless browsers and strictly click elements that are genuinely visible on-screen. The 1,400 IPs you caught are likely just harmless background noise crawling the web; the bots actually harvesting your data probably never touched the trap.

Instead of throwing an outright 403 Forbidden, serve a server-level JavaScript challenge to IPs triggering the trap. If it's a real person, their browser solves it in a fraction of a second and lets them in. A simple python- or curl-based scraper can't execute JS, hits a brick wall, and stops taxing your server.

Don't panic and definitely avoid blanket IP bans. CGNAT is extremely common across Turkish ISPs; banning a single bot IP from a dynamic pool can instantly lock out hundreds of innocent home or office users. Score suspicious activity based on session behavior, not raw IPs.

Correction: I misremembered the figure, it was a bit lower.

search engine bots got caught in ours once and our indexes almost got wiped out, never write firewall ban rules without an rdns check first

Did the hidden link at the bottom have a rel="nofollow" tag, and was that path disallowed in robots.txt? If it wasn't listed in robots.txt, it's completely normal for search engine crawlers to follow it.

Instead of just adding hidden fields to your honeypot, implement a timestamp check; any form submitted in under 2 seconds is almost guaranteed to be a bot.

I completely agree. When you try to change everything at once, nothing settles.

Good luck with that.

Thanks, that was the answer I was looking for.

We experienced almost the exact same thing last year. Hasty decisions become decisions you have to fix six months later.

Don't rely on a single measure; go layer by layer. Good luck with that.

You're right.

I agree, and I'd like to emphasize that. When making a decision, first look at what data you have on hand.

Correct me if I'm wrong.

saved.

Great work. Having backups accessible on the same network and with the same identity makes them part of the target.

If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection. Correct me if I'm wrong.

I'm curious too.

Do you think this works at any scale? Taking notes for two weeks yields better results than a six-month estimate.

Of course, it varies if your situation is different.

Great work.