Weave Code
Php Antispam Laravel Package
cleantalk/php-antispam
CleanTalk PHP Anti-Spam is a lightweight PHP library that blocks spam form and comment submissions without CAPTCHA. It connects to the CleanTalk cloud service and works with Laravel and other PHP projects.
PHP spam protection. CAPTCHA-free and reCAPTCHA alternative. Powered by background scoring without challenging website visitors.
Frequently asked questions about Php Antispam
- Is cleantalk/php-antispam a Laravel package or a framework-agnostic PHP SDK?
- It is a framework-agnostic PHP SDK, not a Laravel package. It ships with no service provider, config publish command, facade, or validation rule, so Laravel integration means writing a thin adapter layer you own. That adapter is usually a small service provider plus config, a custom validation rule, and optionally middleware.
- How do I install and configure CleanTalk PHP Anti-Spam in a Laravel app?
- Install it with composer require cleantalk/php-antispam and obtain an API key from a CleanTalk account. Store the key in config/services.php or a dedicated config file and read it from the environment. Because there is no package auto-discovery or publishable config, you register your own binding and call the SDK at the points where you currently run CAPTCHA or spam checks.
- Which Laravel and PHP versions does CleanTalk PHP Anti-Spam support?
- The SDK does not depend on Laravel framework internals, so it fits any Laravel version in current support. The practical constraint is the package's own PHP version matrix, which you should confirm against your runtime before installing. Check the Composer requirements and test on your target PHP version rather than assuming broad compatibility.
- How do I use CleanTalk Anti-Spam in a Laravel FormRequest or validation rule?
- There is no built-in Laravel validation rule, so you create a custom rule that calls the SDK and returns a validation failure when the verdict is spam. Use that rule inside your FormRequest rules array for registration, login, contact, comments, and password reset. Keep the API call behind your own adapter so you can swap in a fake in tests and control the fail-open or fail-closed policy.
- What visitor data does CleanTalk PHP Anti-Spam send to the cloud?
- The service evaluates submissions in the cloud, which means visitor IP, email, and message content leave your infrastructure for a third party. Before production traffic you need a DPA, a privacy-policy update, and a data-minimization review for your jurisdiction. Confirm the exact fields transmitted and the retention period with CleanTalk rather than inferring them from the SDK alone.
- What happens when the CleanTalk API is unreachable or times out?
- Each protected submission makes a synchronous outbound call, so an outage adds tail latency and creates a failure domain outside your control. You must make an explicit product decision between fail-open, which may leak spam, and fail-closed, which may block legitimate users. Set clear timeouts, log the verdict and latency, and alert on error rates instead of letting the default behavior happen by accident.
- How can I test CleanTalk spam checks in CI without calling the live API?
- Testability depends on the client transport: Guzzle or PSR-18 can be mocked and observed through Laravel's HTTP client, while raw curl or file_get_contents is harder to fake and instrument. Put the SDK behind your own interface so tests can inject a deterministic fake. Also ask CleanTalk whether a sandbox or test mode exists with predictable responses for CI.
- Can I replace reCAPTCHA with CleanTalk Anti-Spam immediately?
- Do not remove CAPTCHA on day one. Run CleanTalk in shadow mode for two to four weeks, calling the API and logging the verdict without acting on it, then compare its decisions against your current CAPTCHA outcomes and known-good accounts. Once the false-positive rate is acceptable, remove the client widget from the lowest-risk form first and keep a challenge as a fallback for flagged submissions.
- How maintained is cleantalk/php-antispam and what are the alternatives?
- The repository has a low star count and an unclear community footprint, so scrutiny of the client code itself is limited, although CleanTalk has a broad CMS plugin presence. Pin the package version, monitor releases, and own your adapter so switching is feasible. Alternatives include reCAPTCHA or hCaptcha, Laravel honeypot and rate-limiting packages, and disposable-email or content-rule checks, which can also complement CleanTalk.
- What is the best way to integrate CleanTalk Anti-Spam into Laravel architecture?
- Use a small service provider plus config for the API key, a custom validation rule for FormRequest usage, middleware for unauthenticated endpoints, and a listener on relevant domain events. Keep your existing honeypots, rate limiting, disposable-email checks, and content rules because CleanTalk complements rather than replaces them. Expect roughly one to three developer-days including tests, configuration, and a shadow-mode rollout.
Weaver
How can I help you explore Laravel packages today?