I do this but I also put a javascript field that is already checked and js unchecks it. not great for no script users but pretty good for any random bot that is using curl or some other scripting language and doesn’t check your trap box.
You can make that checkbox visible by default and put label "I'm not a bot" and uncheck + hide it using JS, that way noscript users will still see the checkbox and uncheck it manually.
Bots might be smart enough to uncheck that from the label; maybe text near the top of the form that says “please uncheck the checkbox near the submit button”?
You could use CSS to place label and checkbox visually close but completely unrelated in the DOM. Not great for accessibility, but better than the current situation.
