Weave Code
Livewire Honeypot Laravel Package
blendbyte/livewire-honeypot
Blendbyte Livewire Honeypot provides lightweight, CAPTCHA-free spam protection for Laravel Livewire forms. It uses hidden honeypot fields and timing checks to catch automated submissions, helping keep forms simple, accessible, and user-friendly for real visitors.
Honeypot + time-trap spam protection for Livewire 4 forms. No CAPTCHAs, no external requests.
Frequently asked questions about Livewire Honeypot
- How do I install blendbyte/livewire-honeypot in a Laravel application?
- Install the package with Composer using composer require blendbyte/livewire-honeypot. Laravel package discovery registers the service provider, and you can publish the config if you need to change defaults. Add the honeypot component inside the form you want to protect.
- Does blendbyte/livewire-honeypot work with plain HTML forms or only Livewire components?
- Since version 2.2.0 the honeypot component emits a signed token that works with plain HTML forms posting to a controller, not just Livewire components. That means you can use the same anti-spam mechanism on marketing, contact, and lead forms that were never Livewire components. Older 2.1 and earlier releases were tied to the Livewire component lifecycle.
- Which Laravel and Livewire versions does blendbyte/livewire-honeypot support?
- The package is built for Laravel applications using Livewire 4 forms. Check the composer.json constraints in the repository for the exact supported Laravel and PHP versions before adding it to an older project. If you are on an earlier Livewire major version, confirm compatibility first.
- How does the honeypot and time trap work compared with CAPTCHA?
- It uses a hidden bait field plus a timing check instead of a CAPTCHA or external service. Real users leave the bait empty and submit after a natural delay, while bots tend to fill hidden fields or post too quickly. Because everything runs locally, there are no third-party requests, privacy trade-offs, or image challenges.
- Why does my Livewire honeypot form fail with a form expired message?
- Version 2.2.0 enables a maximum fill-time gate by default, so forms that stay open too long are rejected at submit with an expiry-style message. If you have long-lived forms such as multi-step claims, saved-draft checkouts, or slow mobile sessions, raise HONEYPOT_MAXIMUM_FILL_SECONDS. The old advice to increase the minimum fill time above one hour also requires a matching maximum.
- Which key signs the honeypot token and what happens when I rotate APP_KEY?
- Signed tokens mean form validity depends on a signing key, so confirm whether the package uses APP_KEY or its own configured key. Rotating that key invalidates in-flight forms, which can appear to users as a form expired message rather than a configuration error. In multi-app or load-balanced deployments, make sure every node shares the same key.
- How do I select the honeypot bait field in Dusk or Pest browser tests?
- Browser tests should locate the bait field by its wire:model binding, because the field name is now generated per form instead of being a stable referral-style name. Dusk or Pest tests that target the old hidden field name or class will break silently. A badly written test can even pass for the wrong reason, because an unfilled honeypot lets the submission succeed.
- Does token_min_length still do anything in blendbyte/livewire-honeypot 2.2.0?
- In 2.2.0 the token_min_length config key is ignored, so changing it no longer affects security behaviour. Treat any existing value as a false assurance and remove it from your config and documentation. The key is expected to be removed in 3.0, but you should not wait until then to clean it up.
- Is HONEYPOT_LOG_VALUE safe to enable in production?
- HONEYPOT_LOG_VALUE writes attacker-controlled input into your logs, which creates log-injection and log-volume risks. It can also capture data from real users who trip the trap through autofill. Keep it off by default, enable it only temporarily for tuning, and never leave it on in production.
- Is upgrading blendbyte/livewire-honeypot from 2.1 to 2.2 safe for existing forms?
- The 2.1 to 2.2 upgrade is described as no-code-change for typical Livewire forms, but you should review three behavioural changes: token expiry, the event reason, and test selectors. Confirm the signing key and rotation story, raise the maximum fill time where needed, and fix browser tests that hardcode the bait field name. Run a staging pass before production.
Weaver
How can I help you explore Laravel packages today?