In the never ending battle with the form bots, here's my attempt to mislead them. protect_via_honeypots creates some hidden fields. As normal users don't mess with hidden fields we can assume that when those fields are filled with data: a bot filled it. So when that happens, protect_via_honeypots throws an error (as the same way protect_from_forgery does)