Weave Code
Bot Detection Bundle Laravel Package
setono/bot-detection-bundle
A Symfony bundle for detecting bots and crawlers from request data, helping you filter automated traffic in analytics, block unwanted scrapers, and serve tailored responses to human visitors.
Easily detect bots in your Symfony application
Frequently asked questions about Bot Detection Bundle
- What does setono/bot-detection-bundle do?
- It detects bots and crawlers from request data so you can filter automated traffic out of analytics, block unwanted scrapers, and serve different responses to human visitors. It is a Symfony bundle, which means its value is delivered through Symfony's dependency injection extension, configuration tree, and service container wiring. Underneath the bundle is almost certainly a standalone user-agent parsing library from the Matomo DeviceDetector or CrawlerDetect family. Treat it as a reference implementation of how to wire that detector rather than as a package you install directly into a Laravel app.
- Can I use setono/bot-detection-bundle in a Laravel application?
- Composer will install it, but bootstrapping will not happen because Laravel has no bundle auto-registration, so the detector service is never registered and no configuration is loaded. You can manually require the bundle's extension class inside a Laravel service provider as a fallback, but that pulls symfony/framework-bundle, symfony/http-kernel, and symfony/dependency-injection into your app for a single feature. The preferred path is to require the underlying detection library directly and own a small adapter plus a service provider and middleware. That keeps the capability while dropping the Symfony plumbing you do not need.
- How do I detect bots in Laravel without installing the Symfony bundle?
- First inspect the bundle's composer.json to identify the detection library it wraps and its version constraint, then require that library directly in your Laravel project. Define an application-level interface such as App\Support\Detection\BotDetector with an isBot(string $userAgent): bool method, and bind a single implementation in a BotDetectionServiceProvider. Publish a config/bot-detection.php file for allowlists, denylists, cache TTL, and enforcement mode. Finish with a ClassifyUserAgent middleware that attaches the verdict to the request and logs it, leaving blocking or throttling to a separate downstream concern.
- What are the alternatives to setono/bot-detection-bundle for Laravel?
- For user-agent bot matching, CrawlerDetect and the Matomo DeviceDetector library are the usual choices and both are framework-agnostic, so they drop into a Laravel service provider cleanly. jenssegers/agent is a common Laravel-friendly wrapper if you also want device and platform parsing. General user-agent parsers such as whichbrowser or the browscap data set cover broader profiling but are heavier than a simple bot check. Any of these avoids the Symfony bundle layer while giving you the same detection capability.
- Is user-agent bot detection reliable enough to block scrapers?
- User-agent string matching is trivially spoofed, so it is an analytics-hygiene and cost-control tool, not a security control, and it should never be positioned as one. If you need to block rather than classify, pair user-agent matching with IP-range or ASN verification against published crawler ranges such as Google's and Bing's. Measure your false-positive rate against a labeled sample of your own access logs before enabling enforcement. Uptime monitors, partner integrations, and legitimate crawlers are the usual casualties of an over-broad denylist.
- How do I block or throttle detected bots in Laravel with middleware?
- Keep classification and enforcement separate: a ClassifyUserAgent middleware should only attach the verdict to the request and log it, while blocking, throttling, or serving alternate content happens in its own middleware or rate limiter. This separation lets you run detection in observe-only mode first and review the results in your logs. Once you trust the verdicts, layer enforcement on top using a config flag so you can flip it off in production without a deploy. Store the verdict on the request attributes so downstream middleware and controllers read it without re-parsing the user agent.
- Should I cache bot detection results in Laravel?
- Yes, because regex evaluation against the user-agent string is the only real cost and the cardinality of distinct user agents is bounded in practice. Key the cache by a hash of the user-agent string and set a TTL from your config file, so repeat traffic from the same client is a single cache lookup. This matters most on high-traffic routes where classification runs on every request. Use your standard Laravel cache store and remember that a cached verdict is only as good as the detection rules behind it, so flush on rule changes.
- Will setono/bot-detection-bundle conflict with Laravel's Symfony components?
- This is the primary integration hazard. The bundle's Symfony version constraints may conflict with the Symfony components Laravel already pins, such as symfony/http-foundation, symfony/http-kernel, and symfony/console. Resolve it in a throwaway branch first and inspect the lock file diff before committing to anything, because a failed resolution or a surprise major-version bump of a shared component can destabilize the whole app. In practice, requiring the underlying standalone library instead of the bundle sidesteps this entirely.
- How do I test bot detection in a Laravel app?
- Unit test the detector implementation against a labeled set of user-agent strings covering Googlebot, Bingbot, uptime monitors, partner integrations, and ordinary browsers. Feature test the middleware by sending requests with spoofed User-Agent headers and asserting the verdict lands on the request attributes. Then validate against reality by replaying a sample of your own access logs and measuring the false-positive and false-negative rates before you enable enforcement. Keep the labeled fixture set in the repository so rule changes are regression-tested.
- Is setono/bot-detection-bundle production ready and actively maintained?
- The repository shows roughly eight stars and zero dependents, which means effectively no production validation, no community review, and a very small bus factor. The release metadata should be verified against the actual commit history before any decision, since anomalous release dates often indicate a single squashed push rather than sustained maintenance. Combined with the Symfony-only architecture, the technical risk is high relative to the value delivered in a Laravel app. Requiring the underlying detection library directly gives you the same capability with a dependency you can evaluate and version-pin on its own merits.
Weaver
How can I help you explore Laravel packages today?