Keep bots out of your Google Sheet lead form (honeypot + time trap)

Description and use

Bots are blocked by a honeypot field and a time trap, while legitimate users submit normally.

Problem

Public lead forms attract bots that spam Google Sheets.

Outcome

Bot traffic is effectively blocked while human leads are processed normally.

Workflow

• Add hidden honeypot input named "company" with off‑screen CSS, aria‑hidden and tabindex="-1".
• Add hidden input "t" to store timestamp via JavaScript.
• In doPost, verify shared token.
• If honeypot field is non‑empty, return fake success.
• If time elapsed since timestamp is less than MIN_SECONDS, return fake success.
• Validate email format; if invalid, return error.
• Append valid lead to "Leads" sheet.
• Return success JSON.

Evidence

Add two things to the form from the webhook post: ... <input name="company" tabindex="-1" autocomplete="off" aria-hidden="true" style="position:absolute;left:-9999px"> ...

Source

const MIN_SECONDS = 3; ... if (!t || (Date.now() - t) < MIN_SECONDS * 1000) { return json({ok:true}); }

Source

Notice both bot rejections return ok: true. Telling a bot exactly why it failed is free debugging help, so give it a fake win and move on.

Source