- What is florentingarnier/spam-protection and how does it work?
- It is a Laravel package for adding configurable spam protection to forms without relying on an external CAPTCHA service. It combines honeypot fields, single-use timed tokens, proof-of-work challenges, rate limiting, IP reputation checks and gibberish detection. These layers block common bot submissions while keeping genuine user submissions smooth and mostly invisible.
- How do I install florentingarnier/spam-protection in a Laravel application?
- Install it with Composer using composer require florentingarnier/spam-protection. Then publish the package configuration and register any middleware or service provider exactly as described in the repository README. Review the published config file to enable the checks you want for each form.
- Which Laravel versions does this spam protection package support?
- The supported Laravel and PHP versions are defined in the package composer.json and summarized in the README. Check those constraints before installing, especially if your application is on an older Laravel release. If you plan a framework upgrade, confirm compatibility in the repository or test the package in a staging branch first.
- How do I configure honeypot fields and timed tokens for my forms?
- After publishing the configuration, enable the honeypot and timed-token features and set their options, such as field names and minimum submission time. Add the corresponding honeypot field and token to your Blade form markup as documented. The package validation rules then reject submissions where the honeypot is filled or the form is submitted too quickly.
- What is proof of work in this package and will it slow down real users?
- Proof of work asks the browser to compute a small challenge before submission, which is cheap for a real user but costly for bots sending many requests. The difficulty is configurable, so you can balance protection against client-side cost. Genuine users normally do not notice the challenge because it runs automatically in the background.
- How do rate limiting and IP reputation work in florentingarnier/spam-protection?
- The package can limit how often a single IP may submit a form within a time window and can check IPs against reputation or block lists. Requests that exceed the limits or come from untrusted IPs are rejected by the configured validation or middleware. You control the thresholds and lists in the configuration so you can tune strictness for your traffic.
- Can it block specific domains, IP addresses, and gibberish form submissions?
- Yes. The package supports blocked domain and IP lists plus validation rules that detect gibberish or randomly typed content. This is useful for contact forms, comment forms and signup forms where bots often submit nonsense text or disposable domains. All of these checks are configurable and can be enabled per form or route.
- How do I test forms protected by this package in automated tests?
- Disable or bypass the spam checks in your testing environment through the package configuration, or use the test helpers described in the README. Then your feature tests can submit forms normally without solving timed tokens or proof-of-work challenges. Keep a separate staging check with protection enabled to confirm the real production flow still works.
- Is this package a good alternative to reCAPTCHA or hCaptcha?
- It is designed as an invisible CAPTCHA alternative that avoids third-party scripts and external verification services. It can reduce friction and privacy concerns, but no single technique stops every spammer, especially determined human spam. Many teams combine it with content moderation or additional checks for high-risk forms.
- Is florentingarnier/spam-protection maintained and safe to use in production?
- Review the repository releases, open issues and recent commit activity before adopting it, and pin a specific version in composer.json. Test the configuration in staging and monitor blocked submissions so you can adjust thresholds and avoid false positives. Because it is open source, you can also review the code and license to confirm it meets your production requirements.