Laravel Honeypot Laravel Package
spatie/laravel-honeypot
Spatie's laravel-honeypot blocks spam form submissions using an invisible honeypot field plus a timestamp check. Just add the x-honeypot Blade component to your form.
spatie/laravel-honeypot protects public forms from spam bots without CAPTCHAs or user friction. It adds an invisible honeypot field that real users never see but bots dutifully fill in, plus an encrypted timestamp field that catches submissions made suspiciously fast. When either check trips, the request is discarded before it reaches your application logic.
Getting started takes one line: drop the <x-honeypot /> Blade component into any form. Values can also be passed manually to your view layer, making it easy to integrate with Inertia or other frontends.
- Blade component with zero configuration required
- Encrypted timestamp-based minimum fill-time check
- Automatically blocks and discards spam requests
- Manual value passing for Inertia and custom views
- Fully customizable field names and validation behavior
- How do I add honeypot protection to a Laravel Blade form?
- Simply include the `<x-honeypot />` component inside your form. The package automatically adds an invisible field that bots will fill, triggering spam detection. No manual field setup is needed.
- Does this work with Inertia.js or Livewire?
- Yes. For Inertia, pass the honeypot values manually via `$honeypot->field()` and `$honeypot->timestamp()`. Livewire support is similar—use the provided methods to inject the fields into your components.
- What Laravel versions are supported?
- The package is officially tested with Laravel 10 and 11, but it’s backward-compatible with Laravel 8+. Check the `composer.json` constraints for PHP 8.1+ requirements.
- How do I configure the minimum submission time?
- Edit `config/honeypot.php` and adjust `amount_of_seconds`. The default (3 seconds) balances bot detection with legitimate user experience. Lower values may increase false positives.
- Will this break my existing forms if I enable it globally?
- No, but enabling globally via `$middleware` risks unintended side effects. Instead, scope the middleware to specific routes or middleware groups in `app/Http/Kernel.php` for granular control.
- How do I handle false positives (e.g., fast typists)?
- Increase `amount_of_seconds` in the config or extend the `SpamResponder` class to customize responses (e.g., log instead of rejecting). Monitor logs for false positives and adjust thresholds.
- Does this work with Content Security Policy (CSP)?
- Hidden fields may trigger CSP violations if not configured. Disable `with_csp` in the config or adjust your CSP policies to allow inline styles for the honeypot field. Use `spatie/laravel-csp` for integration.
- Can I whitelist certain forms from honeypot protection?
- Yes. Exclude routes by adding `protected $dontFilter = ['route-name'];` to your form request class or use middleware groups to opt out specific routes.
- How do I test if the honeypot is working?
- Manually submit a form with a filled honeypot field to verify rejection. Use bot testing tools (e.g., Screaming Frog) to simulate spam. Check Laravel logs for `SpamException` entries.
- Are there alternatives to this package for Laravel spam protection?
- Yes. Consider `laravel-recaptcha` for CAPTCHAs, `spatie/laravel-activitylog` for monitoring, or `laravel-honeypot`’s timing-only mode if you prefer minimalism. Compare false-positive rates and ease of integration.
How can I help you explore Laravel packages today?