Keep bots out of your Google Sheet lead form (honeypot + time trap)

说明与用途

通过蜜罐字段和时间陷阱阻止机器人提交表单，真实用户正常提交。

问题

Public lead forms attract bots that spam Google Sheets.

结果

Bot traffic is effectively blocked while human leads are processed normally.

工作流

• Add hidden honeypot input named "company" with off‑screen CSS, aria‑hidden and tabindex="-1".
• Add hidden input "t" to store timestamp via JavaScript.
• In doPost, verify shared token.
• If honeypot field is non‑empty, return fake success.
• If time elapsed since timestamp is less than MIN_SECONDS, return fake success.
• Validate email format; if invalid, return error.
• Append valid lead to "Leads" sheet.
• Return success JSON.

证据

Add two things to the form from the webhook post: ... <input name="company" tabindex="-1" autocomplete="off" aria-hidden="true" style="position:absolute;left:-9999px"> ...

来源

const MIN_SECONDS = 3; ... if (!t || (Date.now() - t) < MIN_SECONDS * 1000) { return json({ok:true}); }

来源

Notice both bot rejections return ok: true. Telling a bot exactly why it failed is free debugging help, so give it a fake win and move on.

来源