Livewire Honeypot Laravel Package

Product Decisions This Supports

• Build vs. buy on bot/spam defense. Adopting this package replaces bespoke honeypot middleware, token signing, and expiry logic we would otherwise maintain ourselves. Release 2.2.0 materially widens the buy case: <x-honeypot /> now works in plain forms posting to a controller (with a signed token) as well as Livewire forms, so a single dependency covers every public form surface instead of two implementations.
• Form-funnel roadmap. Supports committing to "spam-resistant lead/contact/signup forms with no visible challenge" — invisible defense rather than a CAPTCHA checkbox. That is a UX positioning decision with conversion implications, and this release keeps it invisible while removing the previous request-per-bait-fill behavior.
• Expiry as a product policy knob, not a bug. HONEYPOT_MAXIMUM_FILL_SECONDS (with 0 to disable) turns "how long may a form legitimately stay open?" into an explicit setting, paired with a clear user-facing "This form has expired" message. PMs must decide this per form type — short-lived marketing forms vs. long-lived applications, claims, or saved drafts.
• Measurable spam and false-positive rates. The form_expired event reason (alongside bait-filled signals) gives analytics a real taxonomy for blocked submissions, so tuning is evidence-based rather than guessed. This is the difference between "we think spam dropped" and a dashboard.
• Accessibility and support-cost reduction. The hidden field now uses screen-reader-only CSS under an inconspicuous class, and bait names are generated per form (e.g. referral_3f9a) so browsers and password managers leave them alone. That targets a known ticket generator: autofill collisions and assistive-tech complaints on hidden inputs.
• Privacy posture is now an explicit switch. HONEYPOT_LOG_VALUE is opt-in and off by default; logging a filled bait value means recording user-submitted content, so enabling it is a data-handling decision requiring review, not an ops toggle.
• Engineering-velocity line items. HoneypotService::fake() auto-resetting between tests reduces flaky suite behavior, and the token_min_length deprecation gives a scheduled cleanup item to slot into the 3.0 planning window.

When to Consider This Package

Adopt when:

• The stack is Laravel with Livewire and/or Blade forms posting to controllers, and forms are a meaningful acquisition or support surface.
• You want low-friction spam defense with no third-party CAPTCHA vendor, no external JavaScript, and no user-visible challenge.
• You need Livewire and plain-HTML form coverage from one dependency — 2.2.0 makes this a single adoption decision rather than two.
• You want per-form bot traps, expiry semantics, and observable event reasons wired into analytics.
• You want testable spam logic (fake() with automatic reset) instead of untested custom middleware.

Look elsewhere or proceed carefully when:

• You face determined, targeted, or human-assisted abuse. A honeypot is a low-bar filter; keep rate limiting, WAF, or a CAPTCHA fallback for high-risk endpoints.
• Your forms legitimately stay open an hour or more (long applications, claims, saved drafts). You must raise HONEYPOT_MAXIMUM_FILL_SECONDS or set it to 0, or you will reject real users as form_expired.
• Your browser test suite asserts on the hidden field by name — tests must select the bait by wire:model, which is migration work before upgrade.
• Your privacy policy forbids logging submitted field values — keep HONEYPOT_LOG_VALUE off and document that decision.
• You are not on Laravel, or you already have platform-level bot protection with proven effectiveness metrics.
• You cannot absorb a documented upgrade read plus a known 3.0 removal (token_min_length is ignored now and will be deleted).

How to Pitch It (Stakeholders)

Executives: A small, low-risk dependency that cuts form spam and fake signups without adding a CAPTCHA step that costs conversions, without a vendor contract, and without a third-party script on our pages. The 2.2.0 release extends coverage from Livewire-only to standard HTML forms, so one decision covers all our public forms, and blocked submissions now report a reason (including form_expired) so we can quantify impact rather than assert it. The main risk is false positives on unusually long-lived forms, which is manageable through configuration.

Engineering: The upgrade is behavior-compatible for typical apps — no code changes required — but 2.2.0 adds a signed-token path for plain forms, per-form generated bait names, configurable expiry, and an opt-in value log, and deprecates token_min_length (removal in 3.0). Concrete actions: read the upgrade notes before merging; raise HONEYPOT_MAXIMUM_FILL_SECONDS wherever a form legitimately stays open an hour or more; update browser tests to select the bait by wire:model; leave HONEYPOT_LOG_VALUE disabled pending a data review; and schedule the token_min_length removal into the 3.0 window. Net effect is less custom spam code to own and more deterministic tests via fake() auto-reset — at the cost of one documented migration pass and a follow-up cleanup ticket.