Weave Code
Guest Entries Laravel Package
doublethreedigital/guest-entries
Let visitors submit entries to your Statamic collections without needing an account. Guest Entries provides a simple front-end form endpoint with configurable validation, spam protection, and control over which fields and collections guests can post to.
Perform CRUD operations in the front-end of your site.
Frequently asked questions about Guest Entries
- What is the doublethreedigital/guest-entries package used for?
- It is a Statamic add-on for Laravel applications that lets unauthenticated visitors submit entries to configured collections, such as testimonials, job posts, or guest articles. Submissions appear in the Statamic control panel like normal entries, so editors can review and publish them through the existing workflow.
- How do I install Guest Entries in a Laravel application?
- Install it with Composer using doublethreedigital/guest-entries, then complete the usual Statamic add-on setup and enable guest submissions for the collections you want to accept. Render a front-end form that posts to the add-on endpoint. Confirm routes and configuration in the package docs because exact config keys and route names can change between major versions.
- Does Guest Entries support the current Laravel and Statamic versions?
- The package is built for Statamic, which runs on Laravel, but compatibility depends on the specific release line. The 5.2.1 release notes do not state a minimum PHP or Laravel version, so check composer.json and the repository compatibility matrix before upgrading. Pin a version that matches your Statamic major version.
- How do I choose which collections accept guest submissions?
- Guest Entries uses per-collection configuration, so you explicitly allow only the collections that should accept public submissions. Enable the relevant collection in the add-on configuration and expose a form only for that collection. Avoid allowing sensitive collections such as users, orders, or internal content.
- Is Guest Entries safe for production, and how do I reduce spam?
- It is designed for public submissions, but you should treat every guest form as an untrusted input path. Enable built-in validation and spam protection, limit allowed collections and fields, and add rate limiting or a CAPTCHA at your edge if needed. Keep the package on 5.2.1 because it hardens upload, SVG, asset path, and entry lookup behaviour.
- What security fixes are in Guest Entries 5.2.1?
- The release is a security-hardening patch covering upload handling, SVG sanitization, asset path resolution, form parameters when validation is disabled, entry lookups in update and destroy requests, and guest assignment of reserved entry fields. The notes do not include CVE identifiers or severity ratings, so check the repository advisories for disclosure details. Any earlier 5.x deployment should be treated as potentially exposed until upgraded.
- Do I need migrations or config changes to upgrade to 5.2.1?
- The release notes call out no migrations, config republishes, deprecations, or published breaking changes. The practical upgrade is a Composer version bump to 5.2.1 or ^5.2.1. Because the release is security-focused, pin an exact version and run your test suite before rolling out.
- Can guest visitors update or delete existing entries?
- Guest Entries is intended to let visitors create submissions, not manage existing entries. Version 5.2.1 hardens entry lookups in update and destroy requests, which suggests those paths should not be exposed to guests. Verify your routes and authorization rules so public forms can only create entries in allowed collections.
- What are alternatives to Guest Entries for public submissions?
- If you are already on Statamic, Guest Entries is the purpose-built option because submissions become normal entries in the control panel. A custom Laravel controller with a form request, rate limiting, honeypot, and moderation queue is a reasonable alternative when you need full control. Outside Statamic, use standard Laravel validation and authorization rather than adding a CMS-specific dependency.
- How should I test a Guest Entries upgrade in a Laravel app?
- Run your existing automated test suite first, then manually exercise the hardened surfaces: file uploads, SVG rendering, asset path resolution, forms with validation disabled, and guest submissions to entry endpoints. Also test that authenticated editorial workflows still behave as expected. Prefer an exact 5.2.1 pin until you confirm no behavioural regressions.
Weaver
How can I help you explore Laravel packages today?