- How do I install msurguy/honeypot in a Laravel application?
- Run composer require msurguy/honeypot, then optionally publish the config with php artisan vendor:publish so you can adjust the honeypot field name and time threshold. After that, add the @honeypot directive inside your Blade forms and register HoneypotMiddleware on the routes you want protected. There are no migrations, no external services, and no database changes, so a typical integration including tests takes about half a day.
- Which Laravel and PHP versions does msurguy/honeypot support?
- The package targets modern Laravel releases in the 8.x to 11.x range on PHP 8.x, which covers most actively maintained applications. Its dependency tree is very small, so conflicts with other packages are rare. Check the composer.json constraints against your app's Laravel and PHP versions before installing, since a version conflict is the only realistic blocker.
- How does this honeypot package stop spam without a CAPTCHA?
- It uses two silent traps that legitimate users never notice. A hidden form field is rendered in the markup but invisible to humans, so bots that parse the HTML and fill every input identify themselves. An encrypted timestamp is submitted with the form as well, and any submission that arrives faster than the configured threshold is rejected as automated.
- How do I add the honeypot to a Blade form, and do I need the middleware?
- Add the @honeypot directive inside each form and register HoneypotMiddleware on the route groups you want protected. The directive renders the hidden field and encrypted timestamp, while the middleware performs the validation that actually rejects bots. Rolling it out one route group at a time, starting with contact or registration forms, keeps the change low risk and easy to reverse.
- Can I customize the honeypot field name and the time threshold?
- Yes. Publishing the package config lets you change the honeypot field name and the minimum number of seconds a submission must take. Tune the threshold per form, because a two-field contact form can be completed legitimately in a second or two while longer forms rarely are. A config toggle also lets you disengage the check per form without a redeploy if false positives spike.
- How do I test that the honeypot is working in my Laravel app?
- Write feature tests that post to a protected route with the honeypot field filled in and assert the request is rejected, then post with the field empty and assert success. You can simulate a bot submitting too quickly by manipulating the timestamp input to confirm the time Trap fires. These tests double as documentation of the behaviour for future maintainers.
- Will the time-based trap block real users or hurt accessibility?
- It can in edge cases: password managers, browser autofill, and keyboard-only users on very short forms may submit within the threshold. Hide the honeypot field in a way that does not confuse screen readers and keep the minimum delay low to reduce the risk. Watch your logs for the first few weeks and lower or disable the threshold per form if legitimate submissions are blocked.
- Does msurguy/honeypot work with Livewire, Inertia, or API-only forms?
- It fits any Blade-rendered form, including Livewire components and Inertia pages that submit through normal Laravel requests, as long as the directive is actually rendered in the template. Test Livewire explicitly, because its request cycle can bypass middleware you registered on conventional routes. For pure SPA or API clients that never render the hidden fields, the package adds little value and rate limiting should be your primary control.
- Should I replace reCAPTCHA or Turnstile with a honeypot?
- Usually not. Honeypots stop naive bots silently but not determined or headless-browser attackers, so treat them as defense in depth alongside Laravel's throttle middleware, CSRF protection, and a real challenge on high-value endpoints such as login and registration. They work well as a frictionless first layer because they add no user interaction and no third-party dependency.
- Is msurguy/honeypot well maintained, and what if it goes dormant?
- It is a small MIT-licensed package with a single primary maintainer, so bus factor is the main long-term risk, though a release in April 2026 suggests it is active today. Because the code is minimal, forking and vendoring it is cheap, roughly an afternoon of work, so a documented vendoring plan removes most of that risk. For high-value forms you would pair it with rate limiting and a service such as Turnstile rather than relying on it alone.