Weave Code
Antispam Bundle Laravel Package
nucleos/antispam-bundle
Nucleos Antispam Bundle provides configurable spam protection for Symfony applications. It integrates with forms to help block automated submissions, adding lightweight bot-detection checks with minimal configuration and no disruption to normal users. Use it to reduce fake registrations, comments, a...
This bundle provides some basic features to reduce spam in symfony forms.
Frequently asked questions about Antispam Bundle
- Is nucleos/antispam-bundle a Laravel package or a Symfony bundle?
- It is a Symfony bundle, not a Laravel package. It integrates through Symfony's kernel, dependency injection container, and form component hooks, with no Laravel service provider or facade. If your application is Laravel, you cannot install and use it as intended without porting the underlying logic.
- How do I install and enable NucleosAntiSpamBundle in a Symfony application?
- Install it with Composer, enable the bundle in your Symfony kernel or bundles configuration, and configure it under config/packages. You then attach its form type extension or checks to the specific forms you want to protect. The bundle is designed to run in-process with no external service or network calls.
- What spam protection features does this bundle provide?
- It provides lightweight server-side heuristics for Symfony forms, typically a honeypot hidden field and a minimum-submission-time check. A hidden input that humans should leave empty helps catch naive bots, while a form submitted faster than a plausible human threshold is rejected. These are cheap, stateless signals rather than a WAF, rate limiter, IP reputation system, or CAPTCHA.
- Does nucleos/antispam-bundle integrate with Laravel forms or FormRequest?
- No. The bundle hooks into symfony/form and Symfony's DI container, so it has no built-in Laravel form integration, FormRequest validation rule, or Blade component. For Laravel, the practical approach is to port the pattern into a FormRequest and Blade component rather than adding a hard Symfony dependency. The underlying logic is small: validate a hidden field as empty and compare a signed or encrypted timestamp against a threshold.
- Which Symfony and PHP versions does nucleos/antispam-bundle support?
- The repository and current release metadata are the source of truth for supported Symfony and PHP versions, so check composer.json before committing. Symfony major upgrades from 5 to 6 to 7 have changed form and DI APIs, and a low-traffic bundle is where upgrade lag often appears first. Confirm the last commit date and open issues as part of your evaluation.
- How do I configure the honeypot and minimum submission time for individual forms?
- Configuration generally lives in config/packages, and the checks are attached to selected form types rather than every form globally. You should verify in the repository whether thresholds and field names can be tuned per form or only globally. Tune the time threshold against real completion times for your registration, checkout, or contact forms to avoid false positives.
- Can I choose between a silent rejection and a user-visible validation error for spam?
- The bundle is described as offering configurable validation error behavior, but you must confirm the exact options in the current release documentation or source. Decide per form whether you want a generic validation error or a quieter rejection path. Whatever you choose, test the behavior for real users, password managers, and assistive technology.
- Is this bundle sufficient to stop targeted bot attacks, scraping, or credential stuffing?
- No. Honeypot and time-trap checks are trivially defeated by a competent bot author who inspects the HTML, and the bundle is not a WAF, rate limiter, IP reputation service, or CAPTCHA. It can reduce naive automated submissions but should not be used where the requirement is to stop targeted abuse. For stronger threats, evaluate Cloudflare Turnstile, hCaptcha, or rate-limiting middleware alongside this pattern.
- What accessibility and false-positive risks come with honeypot and time-trap spam checks?
- Hidden fields, autofill suppression, and fast-submit rejection can produce false positives for real users, password managers, and assistive technology. A user who submits very quickly, or whose browser autofills hidden inputs, may be blocked even though they are human. Test your specific checkout, registration, and contact forms, and provide a clear recovery path if a legitimate submission is rejected.
- What are the alternatives if we are on Laravel or need stronger spam protection?
- For Laravel, porting the honeypot and signed-timestamp pattern into a FormRequest and Blade component is usually simpler than depending on a Symfony bundle. For stronger protection, evaluate CAPTCHA or turnstile services, rate-limiting middleware, and WAF rules based on your actual threat model. Also weigh the bundle's low adoption, maintainer concentration, and abandonment risk; budget to vendor the small logic if maintenance stalls.
Weaver
How can I help you explore Laravel packages today?