Weave Code
Laravel Honeypot Laravel Package
spatie/laravel-honeypot
Protect Laravel forms from spam bots with a simple honeypot field and submit-time check. Add the x-honeypot Blade component (or pass values manually for Inertia) and automatically discard suspicious submissions with filled traps or too-fast posts.
Preventing spam submitted through forms
Frequently asked questions about Laravel Honeypot
- How do I add honeypot protection to a Laravel Blade form?
- Simply include the `<x-honeypot />` component inside your form. The package automatically adds an invisible field that bots will fill, triggering spam detection. No manual field setup is needed.
- Does this work with Inertia.js or Livewire?
- Yes. For Inertia, pass the honeypot values manually via `$honeypot->field()` and `$honeypot->timestamp()`. Livewire support is similar—use the provided methods to inject the fields into your components.
- What Laravel versions are supported?
- The package is officially tested with Laravel 10 and 11, but it’s backward-compatible with Laravel 8+. Check the `composer.json` constraints for PHP 8.1+ requirements.
- How do I configure the minimum submission time?
- Edit `config/honeypot.php` and adjust `amount_of_seconds`. The default (3 seconds) balances bot detection with legitimate user experience. Lower values may increase false positives.
- Will this break my existing forms if I enable it globally?
- No, but enabling globally via `$middleware` risks unintended side effects. Instead, scope the middleware to specific routes or middleware groups in `app/Http/Kernel.php` for granular control.
- How do I handle false positives (e.g., fast typists)?
- Increase `amount_of_seconds` in the config or extend the `SpamResponder` class to customize responses (e.g., log instead of rejecting). Monitor logs for false positives and adjust thresholds.
- Does this work with Content Security Policy (CSP)?
- Hidden fields may trigger CSP violations if not configured. Disable `with_csp` in the config or adjust your CSP policies to allow inline styles for the honeypot field. Use `spatie/laravel-csp` for integration.
- Can I whitelist certain forms from honeypot protection?
- Yes. Exclude routes by adding `protected $dontFilter = ['route-name'];` to your form request class or use middleware groups to opt out specific routes.
- How do I test if the honeypot is working?
- Manually submit a form with a filled honeypot field to verify rejection. Use bot testing tools (e.g., Screaming Frog) to simulate spam. Check Laravel logs for `SpamException` entries.
- Are there alternatives to this package for Laravel spam protection?
- Yes. Consider `laravel-recaptcha` for CAPTCHAs, `spatie/laravel-activitylog` for monitoring, or `laravel-honeypot`’s timing-only mode if you prefer minimalism. Compare false-positive rates and ease of integration.
Weaver
How can I help you explore Laravel packages today?