feat: add honeypot spam protection to contact form

index.html

@@ -353,6 +353,7 @@
                 </div>
                 <div class="contact-form-wrapper">
                     <form class="contact-form" id="contactForm" action="send-contact.php" method="POST">
+                        <p class="form-note" style="text-align:left; font-style:italic;">Your information is 100% private. We'll never share or sell it to spammers.</p>
                         <div class="form-group">
                             <label for="name">Your Name *</label>
                             <input type="text" id="name" name="name" required placeholder="John Smith">
@@ -376,6 +377,11 @@
                                 <option value="other">Other</option>
                             </select>
                         </div>
+                        <!-- Honeypot field — hidden from humans, visible to bots -->
+                        <div class="form-group form-honeypot" aria-hidden="true" style="display:none;">
+                            <label for="website_url">Leave this blank</label>
+                            <input type="text" id="website_url" name="website_url" tabindex="-1" autocomplete="off">
+                        </div>
                         <div class="form-group">
                             <label for="message">Tell Us About Your Project</label>
                             <textarea id="message" name="message" rows="4" placeholder="Describe what you need cleaned, approximate size, location, etc."></textarea>
@@ -383,7 +389,6 @@
                         <button type="submit" class="btn btn-primary btn-block">
                             Send Message →
                         </button>
-                        <p class="form-note">Your information is 100% private. We'll never share or sell it to spammers.</p>
                     </form>
                 </div>
             </div>

send-contact.php

@@ -21,6 +21,13 @@ $email   = trim($input['email'] ?? '');
 $service = trim($input['service'] ?? '');
 $message = trim($input['message'] ?? '');
 
+// --- Spam honeypot: if the hidden field has a value, it's a bot ---
+if (!empty($input['website_url'] ?? '')) {
+    // Bots fill this; humans don't. Silently succeed.
+    echo json_encode(['success' => true]);
+    exit;
+}
+
 // Validate required fields
 $errors = [];
 if (!$name) $errors[] = 'Name is required';