PHPackages                             msurguy/honeypot - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. msurguy/honeypot

ActiveLibrary[Security](/categories/security)

msurguy/honeypot
================

Honeypot spam prevention

1.4.0(1y ago)4381.2M↓23.3%45[7 issues](https://github.com/msurguy/Honeypot/issues)[2 PRs](https://github.com/msurguy/Honeypot/pulls)11MITPHPPHP >=5.3.0

Since Mar 24Pushed 1y ago13 watchersCompare

[ Source](https://github.com/msurguy/Honeypot)[ Packagist](https://packagist.org/packages/msurguy/honeypot)[ RSS](/packages/msurguy-honeypot/feed)WikiDiscussions master Synced 1mo ago

READMEChangelog (10)Dependencies (5)Versions (23)Used By (11)

Honeypot spam prevention for Laravel applications
=================================================

[](#honeypot-spam-prevention-for-laravel-applications)

How does it work?
-----------------

[](#how-does-it-work)

"Honeypot" method of spam prevention is a simple and effective way to defer some of the spam bots that come to your site. This technique is based on creating an input field that should be left empty by the real users of the application but will most likely be filled out by spam bots.

This package creates a hidden DIV with two fields in it, honeypot field (like "my\_name") and a honeytime field - an encrypted timestamp that marks the moment when the page was served to the user. When the form containing these inputs invisible to the user is submitted to your application, a custom validator that comes with the package checks that the honeypot field is empty and also checks the time it took for the user to fill out the form. If the form was filled out too quickly (i.e. less than 5 seconds) or if there was a value put in the honeypot field, this submission is most likely from a spam bot.

Installation:
-------------

[](#installation)

In your terminal type : `composer require msurguy/honeypot`. Or open up composer.json and add the following line under "require":

```
{
    "require": {
        "msurguy/honeypot": "^1.0"
    }
}

```

Next, add this line to 'providers' section of the app config file in `app/config/app.php`:

```
'Msurguy\Honeypot\HoneypotServiceProvider',

```

Add the honeypot facade:

```
'Honeypot' => 'Msurguy\Honeypot\HoneypotFacade'

```

At this point the package is installed and you can use it as follows.

Usage :
-------

[](#usage-)

Add the honeypot catcher to your form by inserting `Honeypot::generate(..)` like this:

Laravel 5 & above:

```
{!! Form::open('contact') !!}
    ...
    {!! Honeypot::generate('my_name', 'my_time') !!}
    ...
{!! Form::close() !!}

```

Other Laravel versions:

```
{{ Form::open('contact') }}
    ...
    {{ Honeypot::generate('my_name', 'my_time') }}
    ...
{{ Form::close() }}

```

The `generate` method will output the following HTML markup (`my_time` field will contain an encrypted timestamp):

```

```

After adding the honeypot fields in the markup with the specified macro add the validation for the honeypot and honeytime fields of the form:

```
$rules = array(
    'email'     => "required|email",
    ...
    'my_name'   => 'honeypot',
    'my_time'   => 'required|honeytime:5'
);

$validator = Validator::make(Input::get(), $rules);

```

Please note that "honeytime" takes a parameter specifying number of seconds it should take for the user to fill out the form. If it takes less time than that the form is considered a spam submission.

That's it! Enjoy getting less spam in your inbox. If you need stronger spam protection, consider using [Akismet](https://github.com/kenmoini/akismet) or [reCaptcha](https://github.com/dontspamagain/recaptcha)

Testing
-------

[](#testing)

If you want to test the submission of a form using this package, you might want to disable Honeypot so that the validation passes. To do so, simply call the `disable()` method in your test:

```
Honeypot::disable();

$this->visit('contact')
    ->type('User', 'name')
    ->type('user@email.com', 'email')
    ->type('Hello World', 'message')
    ->press('submit')
    ->see('Your message has been sent!');

```

Credits
-------

[](#credits)

Based on work originally created by Ian Landsman:

License
-------

[](#license)

This work is MIT-licensed by Maksim Surguy.

###  Health Score

55

—

FairBetter than 98% of packages

Maintenance43

Moderate activity, may be stable

Popularity60

Solid adoption and visibility

Community37

Small or concentrated contributor base

Maturity68

Established project with proven stability

 Bus Factor1

Top contributor holds 59.8% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~189 days

Recently: every ~395 days

Total

22

Last Release

453d ago

Major Versions

0.3.2 → 1.0.02015-05-14

### Community

Maintainers

![](https://www.gravatar.com/avatar/2ade9196dfd7579226515436798580da4dd124eb7f7c75cc7ec7e01e3eac45f1?d=identicon)[msurguy](/maintainers/msurguy)

---

Top Contributors

[![msurguy](https://avatars.githubusercontent.com/u/585833?v=4)](https://github.com/msurguy "msurguy (49 commits)")[![garygreen](https://avatars.githubusercontent.com/u/1702638?v=4)](https://github.com/garygreen "garygreen (5 commits)")[![danielpaul](https://avatars.githubusercontent.com/u/333233?v=4)](https://github.com/danielpaul "danielpaul (3 commits)")[![laravel-shift](https://avatars.githubusercontent.com/u/15991828?v=4)](https://github.com/laravel-shift "laravel-shift (3 commits)")[![antonioribeiro](https://avatars.githubusercontent.com/u/3182864?v=4)](https://github.com/antonioribeiro "antonioribeiro (2 commits)")[![jdanino](https://avatars.githubusercontent.com/u/10063518?v=4)](https://github.com/jdanino "jdanino (2 commits)")[![JuanDMeGon](https://avatars.githubusercontent.com/u/5510960?v=4)](https://github.com/JuanDMeGon "JuanDMeGon (2 commits)")[![juukie](https://avatars.githubusercontent.com/u/2678657?v=4)](https://github.com/juukie "juukie (2 commits)")[![sdebacker](https://avatars.githubusercontent.com/u/134503?v=4)](https://github.com/sdebacker "sdebacker (2 commits)")[![vybeauregard](https://avatars.githubusercontent.com/u/9206386?v=4)](https://github.com/vybeauregard "vybeauregard (1 commits)")[![stidges](https://avatars.githubusercontent.com/u/4399967?v=4)](https://github.com/stidges "stidges (1 commits)")[![voidgraphics](https://avatars.githubusercontent.com/u/9298484?v=4)](https://github.com/voidgraphics "voidgraphics (1 commits)")[![DevDaveo](https://avatars.githubusercontent.com/u/27490641?v=4)](https://github.com/DevDaveo "DevDaveo (1 commits)")[![LaurentEsc](https://avatars.githubusercontent.com/u/5583887?v=4)](https://github.com/LaurentEsc "LaurentEsc (1 commits)")[![mosanger](https://avatars.githubusercontent.com/u/281736?v=4)](https://github.com/mosanger "mosanger (1 commits)")[![champloo11](https://avatars.githubusercontent.com/u/392717?v=4)](https://github.com/champloo11 "champloo11 (1 commits)")[![nickurt](https://avatars.githubusercontent.com/u/5840084?v=4)](https://github.com/nickurt "nickurt (1 commits)")[![frankmichel](https://avatars.githubusercontent.com/u/236225?v=4)](https://github.com/frankmichel "frankmichel (1 commits)")[![freekmurze](https://avatars.githubusercontent.com/u/483853?v=4)](https://github.com/freekmurze "freekmurze (1 commits)")[![emnsen](https://avatars.githubusercontent.com/u/5148536?v=4)](https://github.com/emnsen "emnsen (1 commits)")

---

Tags

laravelspamFormsHoneypot

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/msurguy-honeypot/health.svg)

```
[![Health](https://phpackages.com/badges/msurguy-honeypot/health.svg)](https://phpackages.com/packages/msurguy-honeypot)
```

###  Alternatives

[proengsoft/laravel-jsvalidation

Validate forms transparently with Javascript reusing your Laravel Validation Rules, Messages, and FormRequest

1.1k2.3M49](/packages/proengsoft-laravel-jsvalidation)[laragear/poke

Keep your forms alive, avoid TokenMismatchException by gently poking your Laravel app

2211.5k](/packages/laragear-poke)[aedart/athenaeum

Athenaeum is a mono repository; a collection of various PHP packages

245.2k](/packages/aedart-athenaeum)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)