PHPackages                             unbotable/unbotable-laravel - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. unbotable/unbotable-laravel

ActiveLibrary[Security](/categories/security)

unbotable/unbotable-laravel
===========================

Laravel integration for Unbotable — privacy-respecting bot and spam protection

v0.1.0-alpha(1mo ago)031[1 PRs](https://github.com/Unbotable/unbotable-laravel/pulls)MITPHPPHP ^8.2CI passing

Since Jun 14Pushed 1mo agoCompare

[ Source](https://github.com/Unbotable/unbotable-laravel)[ Packagist](https://packagist.org/packages/unbotable/unbotable-laravel)[ Docs](https://unbotable.com)[ RSS](/packages/unbotable-unbotable-laravel/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (1)Dependencies (6)Versions (2)Used By (0)

Unbotable for Laravel
=====================

[](#unbotable-for-laravel)

Privacy-respecting bot and spam protection for Laravel forms and logins — no CAPTCHAs for real visitors, no tracking, no third-party data harvesting.

This package is the Laravel client for [Unbotable](https://unbotable.com). It talks to the Unbotable service over HTTP, attaches a short-lived signed token to your forms, and verifies it with middleware. There is **no account and no API key** — you point it at the service and protect a route.

> ### ⚠️ Alpha — coming soon
>
> [](#️-alpha--coming-soon)
>
> Unbotable is in **early testing**. The protection works, but it's young: tuning is ongoing, the API may shift before 1.0, and it will not yet catch every bot. It's built to **fail open** — if anything goes wrong, your forms keep working and real users are never blocked by our bug. Pin an exact version and treat it as defence-in-depth, not a guarantee, until we cut a stable release.

How it works
------------

[](#how-it-works)

1. `@unbotableJs` loads a tiny script that, in the background, measures device and behaviour signals and asks the Unbotable service for a verdict.
2. The service returns a **signed, 5-minute token** (and, for borderline sessions, an invisible proof-of-work the browser solves silently).
3. The `unbotable` middleware verifies the token's signature locally against the service's public key and enforces the verdict.

Raw signals are used for a split second to reach a decision and then thrown away. What little the service stores is one-way and anonymous — you could publish the whole database and not find a single person in it. That's the point.

A local **honeypot** and **timing floor** run independently of the service, so even if Unbotable is unreachable you keep a baseline of protection.

Requirements
------------

[](#requirements)

- PHP 8.2+
- Laravel 12 or 13

Installation
------------

[](#installation)

```
composer require unbotable/unbotable-laravel
```

The service provider, the `unbotable` middleware alias, and the Blade directives register automatically via Laravel package discovery.

Point the package at the service (defaults to the public service):

```
UNBOTABLE_URL=https://unbotable.com
```

Optionally publish the config to tune behaviour:

```
php artisan vendor:publish --tag=unbotable-config
```

Quick start
-----------

[](#quick-start)

### Protect a route

[](#protect-a-route)

```
use Illuminate\Support\Facades\Route;

Route::post('/login', [LoginController::class, 'store'])->middleware('unbotable');

// During rollout, observe without enforcing:
Route::post('/register', [RegisterController::class, 'store'])->middleware('unbotable:log_only');
```

### Blade forms

[](#blade-forms)

Add the script once in your root layout, then drop the honeypot into the form:

```
{{-- layout  or before  --}}
@unbotableJs

    @csrf
    @unbotableHoneypot   {{-- hidden trap field --}}
    @unbotableTimestamp  {{-- JS-free timing floor --}}
    {{-- ...your fields... --}}

```

For a plain Blade form with no framework, auto-wire it — the token is attached on submit:

```
@unbotableWire('#login-form')
```

### Inertia / Vue

[](#inertia--vue)

Add `@unbotableJs` to your root Blade layout, then use the composable. The cleanest way to import it is a Vite alias to the installed package (no copied files to drift):

```
// vite.config.js
import { fileURLToPath } from 'node:url'

export default defineConfig({
  resolve: {
    alias: {
      '@unbotable': fileURLToPath(
        new URL('./vendor/unbotable/unbotable-laravel/resources/js', import.meta.url)
      ),
    },
  },
})
```

```

import { useForm } from '@inertiajs/vue3'
import { useUnbotable } from '@unbotable/useUnbotable'

const unbotable = useUnbotable()
const form = useForm({ email: '', password: '', _unbotable_hp: '' })

const submit = async () => {
  await unbotable.settled()              // let the background assess finish
  unbotable.protect(form).post(route('login'))   // attaches the token + PoW
}

```

Configuration
-------------

[](#configuration)

All settings have sensible defaults; override via env or the published config.

Key (env)DefaultWhat it does`UNBOTABLE_URL``https://unbotable.com`The Unbotable service to verify against`UNBOTABLE_ON_BLOCK``fake_success`On a block verdict: `fake_success` (redirect back with a flag), `abort` (422), or `log_only``UNBOTABLE_ON_UNREACHABLE``open`If the service is unreachable: `open` (allow + log, rely on honeypot/timing) or `closed` (block)`UNBOTABLE_MIN_SUBMIT_SECONDS``2`Submissions faster than this are treated as bots (JS-free)`UNBOTABLE_REPLAY_MAX_USES``3`How many times one token may be reused before rejection`UNBOTABLE_FAKE_SUCCESS_REDIRECT``null`Where `fake_success` redirects (null = back)`fake_success` sets the session key `_unbotable_ok` so your view can show a plausible success message to a bot while quietly dropping the submission.

Fail-open by design
-------------------

[](#fail-open-by-design)

If the service times out, errors, or the script never runs, the package sends a `unreachable` status and the middleware applies `on_unreachable` (default: allow). A genuine **block** verdict always blocks; only outages fail open. We'd rather let a borderline request through than block a real person over our own downtime.

Privacy
-------

[](#privacy)

No cookies, no third parties, no tracking — not even an analytics beacon. Nothing stored is tied to a person: the service keeps only one-way, anonymous hashes that expire on their own within weeks. See the live data at [unbotable.com](https://unbotable.com).

License
-------

[](#license)

MIT — see [LICENSE](LICENSE).

###  Health Score

36

—

LowBetter than 79% of packages

Maintenance91

Actively maintained with recent releases

Popularity10

Limited adoption so far

Community2

Small or concentrated contributor base

Maturity32

Early-stage or recently created project

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

46d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/32c8951f69881cca4fe9b9344e58a4cce78d4de35fa25347131f4f62a3021d2a?d=identicon)[poweredbytomorrow](/maintainers/poweredbytomorrow)

---

Tags

laravelsecurityspamcaptchaHoneypotprivacybot-protectionrecaptcha-alternative

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Code StyleLaravel Pint

### Embed Badge

![Health badge](/badges/unbotable-unbotable-laravel/health.svg)

```
[![Health](https://phpackages.com/badges/unbotable-unbotable-laravel/health.svg)](https://phpackages.com/packages/unbotable-unbotable-laravel)
```

###  Alternatives

[psalm/plugin-laravel

Psalm plugin for Laravel

3345.3M348](/packages/psalm-plugin-laravel)[spatie/laravel-csp

Add CSP headers to the responses of a Laravel app

86611.1M25](/packages/spatie-laravel-csp)[api-platform/laravel

API Platform support for Laravel

58174.6k17](/packages/api-platform-laravel)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)