- How do I install and configure Guest Entries in a Laravel Statamic application?
- Install the addon with Composer using duncanmcclean/guest-entries, then enable the collections that should accept guest submissions in the addon configuration. Guest Entries uses your existing Statamic blueprints for validation and entry storage, so no custom controller or separate model is required. Clear Statamic's caches after changing configuration and test a submission on each configured collection.
- Can anonymous visitors submit entries from a front-end form or API endpoint?
- Yes. Guest Entries is built for unauthenticated submissions, so visitors do not need a user account to create entries. You can post to the configured endpoint from a normal front-end form or an API-style request. Because these requests are guest-facing, pair the endpoint with CSRF protection where applicable, validation, and spam controls.
- How does Guest Entries validate submissions against my collection blueprint?
- The addon applies your collection's blueprint validation rules before saving a guest submission, so entries are checked the same way as control panel entries. Invalid input should be rejected with validation errors rather than stored silently. Version 5.2.1 also hardens form parameters when validation is disabled, so review any forms that run in that mode.
- How do I require moderation before guest entries are published?
- Enable the moderation option for the relevant collection so guest submissions are held for review instead of being published immediately. Moderators can then approve, edit, or reject entries in the Statamic control panel. This is useful for guestbooks, testimonials, and job boards where spam or low-quality submissions are common.
- What spam and honeypot protection does Guest Entries support?
- Guest Entries works with Statamic's built-in spam and honeypot protections, so you can add hidden honeypot fields and use Statamic's spam detection in your forms. Moderation adds a second layer by keeping suspicious submissions out of the published collection until reviewed. For high-traffic public forms, consider rate limiting or a CAPTCHA in addition to the built-in controls.
- Which Statamic and Laravel versions does Guest Entries support?
- Guest Entries is a Statamic addon, so its Laravel compatibility follows the Statamic version you run. Check the package's composer.json and release notes for the exact Statamic and Laravel constraints before installing or upgrading. The security assessment here is based on version 5.2.1, and older 5.x releases should be treated as carrying known issues.
- Is Guest Entries safe for production after the 5.2.1 security fixes?
- Version 5.2.1 contains a batch of security hardening changes covering guest writes, entry lookups, asset paths, invalid input, and SVG handling, so earlier 5.x versions should not be considered safe for public guest forms. Upgrade to 5.2.1 or later and regression-test every guest-facing route, upload path, and form configured with validation disabled. The release notes referenced here do not include a CVE or advisory link, so ask the maintainer for disclosure details if you need them for compliance.
- What breaking behavior should I expect when upgrading to Guest Entries 5.2.1?
- Although 5.2.1 is a patch release, several fixes change behavior: entry lookups in update and destroy are hardened, invalid input is handled differently, existing asset paths are tightened, and guests can no longer set reserved entry fields. Expect some previously accepted requests to return 403, 404, or 422 responses instead of succeeding. Treat the upgrade as a security remediation and run a full regression pass over guest forms, uploads, and API endpoints.
- How should I handle file uploads and SVG assets for guest entries?
- Guest Entries supports an asset upload pipeline, and version 5.2.1 hardens handling of existing asset paths and SVG parsing, which is important because SVG can be a stored-XSS vector. Restrict allowed file types and MIME types, store uploads on a controlled filesystem disk, and avoid serving user-supplied files from a trusted origin without sanitization. After upgrading, test legitimate SVG and image uploads to catch any over-tightening that blocks valid files.
- Should I use Guest Entries or build a custom Laravel controller for guest submissions?
- Guest Entries is a good fit when you want per-collection configuration, blueprint validation, moderation, and spam protection without writing custom controllers. A custom Laravel controller that creates Statamic entries through the API may be preferable if you need highly custom workflows, non-Statamic storage, or your own authorization layer. Either approach must treat guest input as untrusted, especially for uploads, reserved fields, and validation-disabled paths.