PHPackages lukeusher/laravel-honeypot - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Validation & Sanitization](/categories/validation) 4. / 5. lukeusher/laravel-honeypot Abandoned → [spatie/laravel-honeypot](/?search=spatie%2Flaravel-honeypot)Library[Validation & Sanitization](/categories/validation) lukeusher/laravel-honeypot ========================== Preventing spam submitted through forms 4.0.0(5y ago)01001MITPHPPHP ^8.0 Since Dec 27Pushed 4y agoCompare [ Source](https://github.com/LukeUsher/laravel-honeypot)[ Packagist](https://packagist.org/packages/lukeusher/laravel-honeypot)[ Docs](https://github.com/spatie/laravel-honeypot)[ Fund](https://spatie.be/open-source/support-us)[ RSS](/packages/lukeusher-laravel-honeypot/feed)WikiDiscussions master Synced 1mo ago READMEChangelogDependencies (11)Versions (23)Used By (0) Preventing spam submitted through forms ======================================= [](#preventing-spam-submitted-through-forms) #### This is a fork of spatie/laravel-honeypot that can be used with Laravel 6 (LTS) after being upgraded to PHP8. The upstream package only retains support for PHP7 with Laravel 6. [](#this-is-a-fork-of-spatielaravel-honeypot-that-can-be-used-with-laravel-6-lts-after-being-upgraded-to-php8-the-upstream-package-only-retains-support-for-php7-with-laravel-6) [![Latest Version on Packagist](https://camo.githubusercontent.com/8a8216c4dd497471957a5004114e975d674d379970fde7cc45dbf8a9684ccc83/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f7370617469652f6c61726176656c2d686f6e6579706f742e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/spatie/laravel-honeypot)[![GitHub Workflow Status](https://camo.githubusercontent.com/115395313f9190d70a68aa81f33d379ddf4c09c98d3033852600869945ce3d68/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f776f726b666c6f772f7374617475732f7370617469652f6c61726176656c2d686f6e6579706f742f72756e2d74657374733f6c6162656c3d7465737473)](https://camo.githubusercontent.com/115395313f9190d70a68aa81f33d379ddf4c09c98d3033852600869945ce3d68/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f776f726b666c6f772f7374617475732f7370617469652f6c61726176656c2d686f6e6579706f742f72756e2d74657374733f6c6162656c3d7465737473)[![Quality Score](https://camo.githubusercontent.com/b0c37c6b85eb4e689eeffefaf88a6e4e7980d93b8350784f2b78bcb0546400c0/68747470733a2f2f696d672e736869656c64732e696f2f7363727574696e697a65722f672f7370617469652f6c61726176656c2d686f6e6579706f742e7376673f7374796c653d666c61742d737175617265)](https://scrutinizer-ci.com/g/spatie/laravel-honeypot)[![StyleCI](https://camo.githubusercontent.com/4da4b51c754a8b2feaa7419a4741845a97e33d24f710ea1c48c0d7d442b1e752/68747470733a2f2f6769746875622e7374796c6563692e696f2f7265706f732f3136323631373030342f736869656c643f6272616e63683d6d6173746572)](https://github.styleci.io/repos/162617004)[![Total Downloads](https://camo.githubusercontent.com/dfdff048d8b4b69465341d50aede0bacfed7bda995405f5d3bbd66d896499f8a/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f7370617469652f6c61726176656c2d686f6e6579706f742e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/spatie/laravel-honeypot) When adding a form to a public site, there's a risk that spam bots will try to submit it with fake values. Luckily, the majority of these bots are pretty dumb. You can thwart most of them by adding an invisible field to your form that should never contain a value when submitted. Such a field is called a honeypot. These spam bots will just fill all fields, including the honeypot. When a submission comes in with a filled honeypot field, this package will discard that request. On top of that this package also checks how long it took to submit the form. This is done using a timestamp in another invisible field. If the form was submitted in a ridiculously short time, the anti spam will also be triggered. After installing this package, all you need to do is to add a `@honeypot` Blade directive to your form. ``` @honeypot ``` Video tutorial -------------- [](#video-tutorial) In [this video](https://vimeo.com/381197983), which is part of the [Mailcoach](https://mailcoach.app) video course, you can see how the package can be installed and used. Support us ---------- [](#support-us) We invest a lot of resources into creating [best in class open source packages](https://spatie.be/open-source). You can support us by [buying one of our paid products](https://spatie.be/open-source/support-us). We highly appreciate you sending us a postcard from your hometown, mentioning which of our package(s) you are using. You'll find our address on [our contact page](https://spatie.be/about-us). We publish all received postcards on [our virtual postcard wall](https://spatie.be/open-source/postcards). Installation ------------ [](#installation) You can install the package via composer: ``` composer require lukeusher/laravel-honeypot dev-master ``` Optionally, you can publish the config file of the package. ``` php artisan vendor:publish --provider="Spatie\Honeypot\HoneypotServiceProvider" --tag=config ``` This is the content of the config file that will be published at `config/honeypot.php`: ``` use Spatie\Honeypot\SpamResponder\BlankPageResponder; return [ /* * Here you can specify name of the honeypot field. Any requests that submit a non-empty * value for this name will be discarded. Make sure this name does not * collide with a form field that is actually used. */ 'name_field_name' => env('HONEYPOT_NAME', 'my_name'), /* * When this is activated there will be a random string added * to the name_field_name. This improves the * protection against bots. */ 'randomize_name_field_name' => env('HONEYPOT_RANDOMIZE', true), /* * This field contains the name of a form field that will be used to verify * if the form wasn't submitted too quickly. Make sure this name does not * collide with a form field that is actually used. */ 'valid_from_field_name' => env('HONEYPOT_VALID_FROM', 'valid_from'), /* * If the form is submitted faster than this amount of seconds * the form submission will be considered invalid. */ 'amount_of_seconds' => env('HONEYPOT_SECONDS', 1), /* * This class is responsible for sending a response to requests that * are detected as being spammy. By default a blank page is shown. * * A valid responder is any class that implements * `Spatie\Honeypot\SpamResponder\SpamResponder` */ 'respond_to_spam_with' => BlankPageResponder::class, /* * This switch determines if the honeypot protection should be activated. */ 'enabled' => env('HONEYPOT_ENABLED', true), ]; ``` Usage ----- [](#usage) First, you must add the `@honeypot` blade directive to any form you wish to protect. ``` @honeypot ``` `@honeypot` will add two fields: `my_name` and `my_time` (you can change the names in the config file). Next, you must use the `Spatie\Honeypot\ProtectAgainstSpam` middleware in the route that handles the form submission. This middleware will intercept any request that submits a non empty value for the key named `my_name`. It will also intercept the request if it is submitted faster than the encrypted timestamp that the package generated in `my_time`. ``` use App\Http\Controllers\ContactFormSubmissionController; use Spatie\Honeypot\ProtectAgainstSpam; Route::post([ContactFormSubmissionController::class, 'create'])->middleware(ProtectAgainstSpam::class); ``` If you want to integrate the `Spatie\Honeypot\ProtectAgainstSpam` middleware with Laravel's built in authentication routes, wrap the `Auth::routes();` declaration with the appropriate middleware group (make sure to add the `@honeypot` directive to the authentication forms). ``` use Spatie\Honeypot\ProtectAgainstSpam; Route::middleware(ProtectAgainstSpam::class)->group(function() { Auth::routes(); }); ``` If your app has a lot of forms handled by many different controllers, you could opt to register it as global middleware. ``` // inside app\Http\Kernel.php protected $middleware = [ // ... \Spatie\Honeypot\ProtectAgainstSpam::class, ]; ``` ### Disabling in testing [](#disabling-in-testing) By default, any protected form that is submitted in faster than 1 second will be marked as spammy. When running end to end tests, which should run as fast as possible, you probably don't want this. To disable all honeypots in code, you can set the `enabled` config value to `false`. ``` config()->set('honeypot.enabled', false) ``` ### Customizing the response [](#customizing-the-response) When a spammy submission is detected, the package will show a blank page by default. You can customize this behaviour by writing your own `SpamResponse` and specifying its fully qualified class name in the `respond_to_spam_with` key of the `honeypot` config file. A valid `SpamResponse` is any class that implements the `Spatie\Honeypot\SpamResponder\SpamResponder` interface. This is what that interface looks like: ``` namespace Spatie\Honeypot\SpamResponder; use Closure; use Illuminate\Http\Request; interface SpamResponder { public function respond(Request $request, Closure $next); } ``` Even though a spam responder's primary purpose is to respond to spammy requests, you could do other stuff there as well. You could for instance use the properties on `$request` to determine the source of the spam (maybe all requests come from the same IP) and put some logic to block that source altogether. If the package wrongly determined that the request is spammy, you can generate the default response by passing the `$request` to the `$next` closure, like you would in a middleware. ``` // in your spam responder $regularResponse = $next($request) ``` ### Customizing the generated honeypot fields [](#customizing-the-generated-honeypot-fields) To customize output generated by `@honeypot`, you can publish the `honeypot` view with: ``` php artisan vendor:publish --provider="Spatie\Honeypot\HoneypotServiceProvider" --tag=views ``` The view will be placed in `resources/views/vendor/honeypot/honeypotFormFields.blade.php`. This is the default content: ``` @if($enabled) @endif ``` ### Events fired [](#events-fired) Whenever spam is detected, the `Spatie\Honeypot\SpamDetected` event is fired. It has the `$request` as a public property. ### Testing [](#testing) ``` composer test ``` Changelog --------- [](#changelog) Please see [CHANGELOG](CHANGELOG.md) for more information on what has changed recently. Alternatives ------------ [](#alternatives) If you need stronger spam protection, consider using [Google ReCaptcha](https://m.dotdev.co/google-recaptcha-integration-with-laravel-ad0f30b52d7d) or [Akismet](https://github.com/nickurt/laravel-akismet). Contributing ------------ [](#contributing) Please see [CONTRIBUTING](CONTRIBUTING.md) for details. Security -------- [](#security) If you discover any security related issues, please email instead of using the issue tracker. Credits ------- [](#credits) - [Freek Van der Herten](https://github.com/freekmurze) - [All Contributors](../../contributors) This package was inspired by [the Honeypot package](https://github.com/msurguy/Honeypot) by [Maksim Surguy](https://github.com/msurguy). License ------- [](#license) The MIT License (MIT). Please see [License File](LICENSE.md) for more information. ### Health Score 33 — LowBetter than 75% of packages Maintenance20 Infrequent updates — may be unmaintained Popularity10 Limited adoption so far Community18 Small or concentrated contributor base Maturity75 Established project with proven stability Bus Factor1 Top contributor holds 67.4% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~40 days Recently: every ~91 days Total 22 Last Release 1856d ago Major Versions 0.0.1 → 1.0.02018-12-27 1.5.0 → 2.0.02020-03-02 2.3.0 → 3.0.02020-09-17 3.0.1 → 4.0.02021-04-13 PHP version history (7 changes)0.0.1PHP ^7.1 1.2.0PHP ~7.1 1.3.1PHP ^7.2 2.3.0PHP ^7.2|^7.3 3.0.0PHP ^7.4 3.0.1PHP ^7.4|^8.0 4.0.0PHP ^8.0 ### Community Maintainers ![](https://www.gravatar.com/avatar/22eb8803a87595a4e4a2aaaa9f33a9bd8c39ded5e1407ef7fe1cd0de11426cdd?d=identicon)[LukeUsher](/maintainers/LukeUsher) --- Top Contributors [![freekmurze](https://avatars.githubusercontent.com/u/483853?v=4)](https://github.com/freekmurze "freekmurze (87 commits)")[![cmorbitzer](https://avatars.githubusercontent.com/u/5883755?v=4)](https://github.com/cmorbitzer "cmorbitzer (8 commits)")[![larsjanssen6](https://avatars.githubusercontent.com/u/7254997?v=4)](https://github.com/larsjanssen6 "larsjanssen6 (8 commits)")[![rubenvanassche](https://avatars.githubusercontent.com/u/619804?v=4)](https://github.com/rubenvanassche "rubenvanassche (3 commits)")[![LukeUsher](https://avatars.githubusercontent.com/u/740003?v=4)](https://github.com/LukeUsher "LukeUsher (3 commits)")[![amitmerchant1990](https://avatars.githubusercontent.com/u/3647841?v=4)](https://github.com/amitmerchant1990 "amitmerchant1990 (2 commits)")[![mixisLv](https://avatars.githubusercontent.com/u/3735128?v=4)](https://github.com/mixisLv "mixisLv (2 commits)")[![bogdankharchenko](https://avatars.githubusercontent.com/u/32746389?v=4)](https://github.com/bogdankharchenko "bogdankharchenko (2 commits)")[![AlexVanderbist](https://avatars.githubusercontent.com/u/6287961?v=4)](https://github.com/AlexVanderbist "AlexVanderbist (2 commits)")[![mrk-j](https://avatars.githubusercontent.com/u/1250622?v=4)](https://github.com/mrk-j "mrk-j (2 commits)")[![sebastiaanspeck](https://avatars.githubusercontent.com/u/12570668?v=4)](https://github.com/sebastiaanspeck "sebastiaanspeck (1 commits)")[![atymic](https://avatars.githubusercontent.com/u/50683531?v=4)](https://github.com/atymic "atymic (1 commits)")[![drbyte](https://avatars.githubusercontent.com/u/404472?v=4)](https://github.com/drbyte "drbyte (1 commits)")[![Enaah](https://avatars.githubusercontent.com/u/10073766?v=4)](https://github.com/Enaah "Enaah (1 commits)")[![faustbrian](https://avatars.githubusercontent.com/u/22145591?v=4)](https://github.com/faustbrian "faustbrian (1 commits)")[![mercuryseries](https://avatars.githubusercontent.com/u/5163810?v=4)](https://github.com/mercuryseries "mercuryseries (1 commits)")[![noahheck](https://avatars.githubusercontent.com/u/4154306?v=4)](https://github.com/noahheck "noahheck (1 commits)")[![roelgonzalez](https://avatars.githubusercontent.com/u/13934159?v=4)](https://github.com/roelgonzalez "roelgonzalez (1 commits)")[![RogierW](https://avatars.githubusercontent.com/u/9381528?v=4)](https://github.com/RogierW "RogierW (1 commits)")[![alexpriftuli](https://avatars.githubusercontent.com/u/6273200?v=4)](https://github.com/alexpriftuli "alexpriftuli (1 commits)") --- Tags spatielaravel-honeypot ### Embed Badge ![Health badge](/badges/lukeusher-laravel-honeypot/health.svg) ``` [![Health](https://phpackages.com/badges/lukeusher-laravel-honeypot/health.svg)](https://phpackages.com/packages/lukeusher-laravel-honeypot) ``` ### Alternatives [spatie/laravel-honeypot Preventing spam submitted through forms 1.6k6.0M60](/packages/spatie-laravel-honeypot)[proengsoft/laravel-jsvalidation Validate forms transparently with Javascript reusing your Laravel Validation Rules, Messages, and FormRequest 1.1k2.3M49](/packages/proengsoft-laravel-jsvalidation)[spatie/laravel-responsecache Speed up a Laravel application by caching the entire response 2.8k8.2M51](/packages/spatie-laravel-responsecache)[propaganistas/laravel-phone Adds phone number functionality to Laravel based on Google's libphonenumber API. 3.0k35.7M107](/packages/propaganistas-laravel-phone)[roots/acorn Framework for Roots WordPress projects built with Laravel components. 9682.1M97](/packages/roots-acorn)[illuminate/validation The Illuminate Validation package. 18936.7M1.4k](/packages/illuminate-validation) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)