Keep bots out of your Google Sheet lead form (honeypot + time trap)

Описание и применение

Ботам, отправляющим формы, блокируются поля‑ловушки и тайм‑трап, а реальные пользователи продолжают работать без ограничений.

Задача

Public lead forms attract bots that spam Google Sheets.

Результат

Bot traffic is effectively blocked while human leads are processed normally.

Рабочий процесс

• Add hidden honeypot input named "company" with off‑screen CSS, aria‑hidden and tabindex="-1".
• Add hidden input "t" to store timestamp via JavaScript.
• In doPost, verify shared token.
• If honeypot field is non‑empty, return fake success.
• If time elapsed since timestamp is less than MIN_SECONDS, return fake success.
• Validate email format; if invalid, return error.
• Append valid lead to "Leads" sheet.
• Return success JSON.

Доказательства

Add two things to the form from the webhook post: ... <input name="company" tabindex="-1" autocomplete="off" aria-hidden="true" style="position:absolute;left:-9999px"> ...

Источник

const MIN_SECONDS = 3; ... if (!t || (Date.now() - t) < MIN_SECONDS * 1000) { return json({ok:true}); }

Источник

Notice both bot rejections return ok: true. Telling a bot exactly why it failed is free debugging help, so give it a fake win and move on.

Источник