- How do I install johannebert/laravel-spam-protector in a Laravel app?
- Install it with composer require johannebert/laravel-spam-protector, then check the repository README for any config publish step, since Laravel auto-discovers service providers but config files usually need publishing. Review the published configuration and wire the package's check into the forms you want to protect, typically as a validation rule or a manual call in your controller. Run your existing form tests before and after adding the check so you can see exactly what changed.
- Which Laravel versions does laravel-spam-protector v7 support?
- Version 7 declares Laravel 9.x as its target, and the major version bump suggests earlier Laravel lines were dropped rather than supported alongside it. If you are on Laravel 8 or older, treat v7 as part of a framework upgrade rather than a standalone package bump. Confirm the exact constraint by reading the illuminate/* requirements in the package's composer.json instead of relying on the release note.
- Does this package require PHP 8?
- Laravel 9 requires PHP 8.0.2 or newer, so v7 almost certainly inherits that floor and drops PHP 7.x consumers. Verify the require block in composer.json rather than trusting the one-line release note, which only mentions Laravel 9 support. If any service still runs PHP 7.4, plan the PHP upgrade before the package upgrade.
- How does laravel-spam-protector actually detect spam?
- The package checks the submitting IP, name and email against the StopForumSpam API, which maintains a database of reported spam sources. It also advertises configurable blocked keywords, rate limiting and honeypot-style checks that run locally without a network call. Most setups combine both layers so a spammer has to get past the local rules and the reputation lookup.
- How do I configure blocked keywords, rate limits and honeypot checks?
- Configuration is where you define blocked keywords, rate-limit thresholds and which checks are active, so publish the config file first and read through every option. Local rules like keyword lists and submission rate limits are cheap and deterministic, so tune them before leaning on the remote lookup. Keep the config in version control and review keyword list changes like any other code.
- Can I use it without calling an external API?
- The package's overview explicitly says it uses the StopForumSpam API, so plan on at least one outbound HTTP call per check unless the config lets you disable that lookup; the blurb's 'no external services' line conflicts with that, so trust the code and config over the marketing copy. Local checks such as blocked keywords, rate limits and honeypot fields need no network access. If you need a fully offline setup, verify which checks are enabled by default and turn off the remote one.
- How do I test forms protected by this package?
- Replace the HTTP client with Laravel's Http::fake in your tests so StopForumSpam lookups return deterministic responses instead of hitting the network. Cover a clean submission, a flagged submission, and the case where the API errors or times out. You can also override the package config in your test suite to disable remote checks for unrelated feature tests.
- What happens if the StopForumSpam API is slow or down?
- A synchronous API call on the form-submission path adds latency and a hard dependency on StopForumSpam's uptime. Make sure timeouts and connection errors fail gracefully rather than rejecting every submission, and consider failing open to your local keyword and rate-limit rules instead. Log the failure path so you notice when the API starts erroring instead of silently letting spam through.
- Is upgrading from v6 to v7 a breaking change?
- The v7 release note is a single line about Laravel 9 support, which says nothing about code-level BC breaks or exactly what was dropped relative to v6, so assume breakage until proven otherwise. Before upgrading, run composer why-not with the new constraint, diff the two versions, and check whether config keys or publish tags changed. Upgrade the framework first, stabilize it, then bump the package so you can attribute any failure to the right change.
- What are the alternatives to laravel-spam-protector?
- Common alternatives are spatie/laravel-honeypot for honeypot fields, Laravel's built-in rate limiter middleware, and CAPTCHA services such as hCaptcha or reCAPTCHA. Akismet is a heavier option if you need content-based spam scoring rather than IP and email reputation. This package fits when you want StopForumSpam reputation checks plus lightweight local rules without wiring up a CAPTCHA.