Weave Code
Form Shield Bundle Laravel Package
libdevo/form-shield-bundle
LibDevo Form Shield Bundle adds lightweight, configurable protection to Symfony forms, helping block spam and bot submissions. Integrate it with existing forms to validate requests and keep submissions clean with minimal setup.
At a glance
Frequently asked questions about Form Shield Bundle
- What does libdevo/form-shield-bundle do?
- It is a Symfony bundle that adds lightweight, configurable spam protection to your forms. It integrates directly with Symfony's Form component so you can shield any existing form without rewriting controllers or templates. The protection layers include honeypot fields, time-based submission checks and rate limiting per IP or session.
- How do I install and enable the bundle in a Symfony application?
- Install it with Composer using composer require libdevo/form-shield-bundle, then register the bundle in your application's bundle configuration so Symfony can load it. Because it hooks into the Form component through a form type extension, no manual wiring is needed in your controllers or Twig templates. Check the repository README for the exact bundle registration and configuration syntax for your Symfony version.
- Do I need to change my controllers or Twig templates to protect an existing form?
- No. The bundle plugs into Symfony's Form component via a simple form type extension, so protection is applied at the form layer rather than in your controllers or templates. Your existing form types, rendering and submit handling stay as they are, and you tune behaviour through configuration instead of code changes.
- How do the honeypot fields work?
- The bundle adds fields that are invisible to real users but look like ordinary inputs to naive bots that parse and auto-fill form markup. If a submission contains a value in one of those fields, the request is treated as spam and rejected. Because real users never see or fill these fields, legitimate submissions pass through unaffected.
- How does the time-based submission check work?
- The bundle measures how long a visitor takes to complete and submit the form. Submissions that arrive unrealistically fast, which is typical of automated scripts rather than humans, are rejected. This complements the honeypot by catching bots that leave invisible fields empty.
- How does the rate limiting work — per IP or per session?
- Rate limiting blocks repeated submissions from the same source, and the bundle supports limiting either per IP address or per session. That lets you choose the strategy that fits your traffic, for example IP-based limits for public forms and session-based limits for logged-in users. Repeated hits beyond the configured threshold are rejected before they reach your application logic.
- Can I customize the validation rules and error messages?
- Yes. The bundle is built around configurable rules, and both the validation rules and the resulting error messages are fully customizable. You can adjust strictness and wording to match the rest of your application's form feedback instead of relying on hard-coded defaults.
- Can I configure different strictness per form or per environment?
- Yes. Configuration is rule-based, so you can tune strictness per form or per environment. That makes it practical to run relaxed limits in development and stricter checks in production, or to treat a low-traffic contact form differently from a high-traffic public form.
- Does this package work with Laravel?
- No. libdevo/form-shield-bundle is a Symfony bundle built specifically around Symfony's Form component, so it is not a Laravel package and cannot be dropped into a Laravel application. Laravel developers evaluating it should look at Laravel-specific spam protection options such as the framework's rate limiter combined with honeypot validation rules, or a dedicated Laravel package.
- Is the bundle maintained, and how does it compare to CAPTCHA services?
- The bundle takes a lightweight, user-friendly approach: honeypots, timing checks and rate limiting run silently without puzzles or third-party scripts. That is easier on users and avoids external CAPTCHA dependencies, but it will not stop determined, human-assisted abuse the way a CAPTCHA might. Check the repository's commit history and issue tracker to confirm current maintenance activity and compatibility with your Symfony version before adopting it.
Weaver
How can I help you explore Laravel packages today?