Add an Accessible Honeypot Field to your PHP Form

A few days ago, after receiving yet another spam submission from the contact form on my portfolio website, I had an epiphany about how to implement a honeypot to block bots instead of a captcha (which nobody likes anyway). I posted about this on Twitter and user @markdeafmcquire asked how I did it.

Captcha versus honeypot

Captchas are those annoying puzzles you have to solve in order to prove you’re human. They are often inaccessible to people with disabilities and they can be difficult to figure out and pass.

Honeypots are passive, often implemented as hidden form fields that bots will fill out and humans won’t. If that hidden form field has a value, then you know the submission is from a bot and can be rejected.

My honeypot solution

My website uses PHP code with HTML to display the contact form as well as doing a server-side check on the form data when submitted.

screen shot of a contact form with fields for name, email, message subject, message and a check box to send a copy to yourself, then a send message button.

The first thing I had to add was a hidden honeypot form field to trip up bots. I used a radio button.

<label for="honeypot" aria-hidden="true" class="visually-hidden">Honeypot <input type="radio" name="honeypot" id="honeypot" style="display:none" value="1"></label>
  • Include the aria-hidden="true" attribute on the <label> element to hide the honeypot from assistive technologies
  • Use a CSS class to hide the <label> element from sighted users
  • Add style="display:none" to the <input> element, which prevents keyboard users from tabbing to the radio button

The second thing I had to add was a check in the PHP to determine if the radio button was selected when the form was submitted. I set the radio button to value="1" and the form check fails if the value of honeypot==1.

//check for honeypot
if ($_POST['honeypot'] == 1) {
    $problem = TRUE;
}

Since it’s only been a few days, I don’t have enough data to determine if my solution is working well. I will update this post in the future.

Accessible PHP honeypot form

Below is the PHP and HTML for adding an accessible contact form to your website, including the honeypot, and a way for people contacting you to send a copy of the email to themselves. Just update it with your email address.

See the Pen PHP Form Honeypot by Rachele (@racheleditullio) on CodePen.

Reach out to me on Twitter if you have anything to add.

How accessible is the 2020 US census?

Like most US households, I received my 2020 census form in the mail this past week and I decided to see how accessible the process really is since it’s a US government website subject to Section 508 compliance.

envelope for the 2020 US census form

The first thing to note is that someone with low vision or who is blind might have trouble with this whole process because the paper form that arrived in the mail does not have particularly large print nor does it include even cursory instructions in Braille. For deaf or hard of hearing people, there is a TDD number but only if you speak English. I think it’s safe to say that many people with disabilities will have to rely on someone else’s help to complete the process.

Let’s take a look at the website that the paper form directs you to visit: my2020census.gov.

screen shot of the home page for the US 2020 census website

I found a few oddities with the home page while using a screen reader:

  • The very first text a screen reader user encounters is a technology warning: If you are using a screen reader, it is recommended that you use the latest version of Internet Explorer and the JAWs [J-A-W-S] screen reader. I’m testing with Chrome and NVDA and this website should work with all major browser/screen reader combinations.
  • The first focusable element is a “skip to main content” link which works fine for a keyboard user but announces blank when using a screen reader because focus is moved to a <div> element with a role=button but no label.
<div role="button" tabindex="0">
<img src="/static/images/start-here.png" class="img-responsive" alt="Start Here Shape your future">
<button type="button" title="Start Questionnaire" name="Start Questionnaire">Start Questionnaire</button>
<div id="recaptcha-container"></div>
  • And as we can see from the screen shot below, the reading order does not match the focus order. The “skip to main content” link sends focus to after all the important instructional information.
screen shot of the census 2020 home page with the focus on the right side of the page
  • Lastly, neither the home page nor the questionnaire pages have <h1> headings or unique page titles to adequately convey place in site.

Start the questionnaire

At the top of the questionnaire pages is a status bar similar to what you might see during a checkout process for online shopping.

screen shot of the census 2020 status bar starting with address verification, household questions, people questions, then final questions.

There are two problems here:

  1. There isn’t any screen-reader accessible help text explaining that it’s a status bar, like a heading, nor any text to indicate which step the user is currently on so it’s useless for someone using a screen reader.
  2. This is the login in screen but the “Address Verification” step is highlighted in the status bar.

The login form itself has very good screen reader label text for the three form fields.

screen shot of the census ID form fields and login button.
  • Enter the first 4 digits of your Census ID
  • Enter the next 4 digits of your Census ID
  • Enter the last 4 digits of your Census ID

But it’s kind of ironic because someone who can’t see the paper letter with their census ID won’t be able to type it in anyway unless someone reads it off to them.

Address verification section

Once you get past the login screen, the status bar at the top properly indicates to a screen reader user where they are the process: progress bar You are on section 1, the address verification section. But, they are unlikely to benefit from this because every time you click the “Next” button, focus is moved to the question text, not the top of the page.

screen shot of a census question with focus indicator on the question text.

Each question has a “Help” link next to it that opens a modal dialog window which is properly coded by:

  • Moving focus to the modal window heading <h1>
  • Keeping focus in the modal window
  • Providing close buttons to exit the modal window
screen shot of a modal window with focus on the help heading and includes an x button and a close button.

If you click the “Next” button without completing the required fields, you get an alert and the required fields are outlined in a thick, red border.

<div role="alert">Your name is required to continue the 2020 Census questionnaire. If you prefer not to provide your name, please provide a nickname or unique description.</div>
screen shot of an alert message above required form fields that are blank.

The three “Telephone Number” fields are required but leaving them blank triggers a separate alert message after filling out the name fields. All required fields should be clearly indicated both visually and to a screen reader user.

Household questions

When the “Household” section loaded, the screen reader was silent so there’s something going on with managing focus on this section. It’s hard to troubleshoot because the application is not designed to let you go back to previous questions or sections.

Instead of a “Help” link for the first question, there was this link text: For more information on who to include, click here. What the screen reader announced, though, was: Help link popcount question. A look at the code shows there are both a title attribute and an aria-label attribute on the link with this nonsensical name.

<a href="#" title="Help link popcount question" aria-label="Help link popcount question">For more information on who to include, click here.</a>

People questions

Just as with the “Household questions” section, when the questionnaire moved to the “People questions” section, the screen reader was silent and I could see focus remained on the “Next” button that was removed from the DOM.

screen shot of the census dashboard with focus indicator on invisible button.

These are not marked up as headings.

This section asks information about each of the persons entered in the “Household questions” section, including birthday.

screenshot of a form asking for birthdate as month, day, year and then verify calculated age.

After selecting the month, day and year, the next input displays a calculated age but the help text after the label does not get read by a screen reader in forms mode because it is not programmatically associated with it using aria-describedby or located inside the <label>.

<label for="P_AGE_INT">Verify or enter correct age as of April 1, 2020.</label>
<span>For babies less than 1 year old, do not enter the age in months. Enter 0 as the age.</span>

The site does a nice job with its session expiration warning both visually and by sending an alert to screen reader users.

screen shot of a session expiration warning with 17 seconds remaining.

Submit questionnaire

This screen also has a focus management issue. The screen reader doesn’t announce anything when the final screen loads and you can see in the screen shot below how focus remains on the “Next” button that was removed from the DOM.

screen shot of the last screen in the questionnaire with focus left on an element removed from the DOM.

And the same thing happens after clicking the “Submit Questionnaire” button and you’re shown the confirmation page. This site needs more testing with a screen reader and better focus management.

5 Ways to Improve Table Accessibility

I recently came across this example of an HTML table that was marked up correctly, for the most part, but lacked some of the important coding nuances needed to make a table truly accessible. Below is a screen shot of that table with the areas of concern highlighted.

screenshot of an HTML table with 4 columns, a header row, and 6 data rows. Areas of the table are highlighted with the numbers 1 through 5.

Depending on the complexity of your table, it can be helpful to review the Table Concepts tutorial from the W3C Web Accessibility Initiative (WAI).

Here are five things to check when creating your next table.

1) Caption that table

While this table has what looks like a caption of “Choose a plan”, that text was actually marked up as a heading level <h3>. Moving it inside the <table> element and marking it up as a <caption> instead allows assistive technologies (AT), like a screen reader, to announce the text as being programmatically associated with the <table>.

Table with 7 rows and 4 columns, caption, choose a plan

NVDA screen reader

2) Include header text for every column

In this example, the very first table cell is empty. The screen reader announces: row 1 column 1. That’s it. But what about the contents of the rest of the cells in this column? They need a header to explain what they are. Visually, the content author doesn’t want a header for column one, but AT users benefit when the name of the column is announced before the contents of subsequent cells.

To fix this issue, I added a hidden column header for column one of “plan feature.”

<th><span class="visually-hidden">Plan feature</span></th>

Now, when a screen reader gets to the beginning of a new row, it’s clear what content is contained in the first cell of each row.

Row 3, plan feature, column 1, number of users

NVDA screen reader

3) Use alt attributes meaningfully

The content author decided to use green check mark images to indicate when a plan feature is included in a particular plan, but they didn’t include alt attributes. AT users have no way of knowing when a feature is included because the cells with images don’t communicate anything.

To fix this, make sure you include alt text on images that provides meaning to the user. An alt attribute of “check mark” would not be meaningful even though it’s visually correct. Instead, I used “feature included.” (Though I would argue using an icon font would be better than an image.)

<td><img src="icon-checkmark-green.svg" alt="feature included"></td>

Team plan, column 3, [graphic] feature included

NVDA screen reader

4) Have data in every table cell

When a feature is not included, we must also communicate that to AT users. The last row of the table has three empty cells which indicate to sighted users that a feature is not included, but like 2) above, we need to add some hidden helper text.

<td><span class="visually-hidden">not included</span></td>

Personal plan, column 2, not included

NVDA screen reader

5) Check your (con)text

Screen readers don’t always handle abbreviations and punctuation as expected. I found two interesting examples with this table. First, the number of users for the Team plan visually looks like “2-50” but it gets announced as “250” because the hyphen is ignored. To accurately convey this meaning, we can add the word “to” as visually-hidden helper text, and we can hide the hyphen from AT to be safe.

<td>2<span aria-hidden="true">-</span><span class="visually-hidden">to</span>50</td>

Team plan, column 3, two to fifty

NVDA screen reader

Second, the plan feature “2FA” in row six does not get announced properly. My screen reader announces this as “2-fah”, not “2-F-A”. Again we need to add helper text for AT users.

<td><span aria-hidden="true">2FA</span><span class="visually-hidden">2 factor authentication</span></th>

Row 6, plan feature, column 1, 2 factor authentication

NVDA screen reader

Please check out the full HTML for this <table> in my first Codepen entry.

See the Pen Accessible Table by Rachele (@racheleditullio) on CodePen.