PHPackages                             xaniashield/laravel - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. xaniashield/laravel

ActiveLibrary

xaniashield/laravel
===================

Privacy-first, EU-hosted spam protection for Laravel forms. Official Laravel client for the Xania Shield API.

v1.0.0(1mo ago)01MITPHPPHP ^8.1

Since Jul 15Pushed 1mo agoCompare

[ Source](https://github.com/xaniacode/xaniashield-laravel)[ Packagist](https://packagist.org/packages/xaniashield/laravel)[ Docs](https://xaniashield.com)[ RSS](/packages/xaniashield-laravel/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (1)Dependencies (2)Versions (2)Used By (0)

Xania Shield for Laravel
========================

[](#xania-shield-for-laravel)

Privacy-first, EU-hosted spam protection for Laravel forms. This is the official Laravel client for the [Xania Shield](https://xaniashield.com) API — block bots and spam across your forms without CAPTCHAs, without Google, and without sending visitor data to third-party AI services.

- **No CAPTCHAs** — works invisibly in the background
- **EU-hosted & GDPR-friendly** — local statistical analysis, no Big Tech
- **Fail-open by design** — if the API is unreachable, your forms keep working
- **Drop-in** — one line per form, with optional honeypot and timing signals

Requirements
------------

[](#requirements)

- PHP 8.1+
- Laravel 10, 11, 12, or 13
- A Xania Shield API key (create one free at [app.xaniashield.com](https://app.xaniashield.com))

Installation
------------

[](#installation)

```
composer require xaniashield/laravel
```

The service provider and `Shield` facade are auto-discovered — no manual registration needed.

Publish the config file (optional):

```
php artisan vendor:publish --tag=shield-config
```

Add your credentials to `.env`:

```
SHIELD_API_KEY=xshd_live_your_key_here
SHIELD_FAIL_OPEN=true
# Optional, only if you use the timing signal:
SHIELD_TIMING_SECRET=a-long-random-string
```

Usage
-----

[](#usage)

### Basic — analyze a submission

[](#basic--analyze-a-submission)

Inject the client (or use the `Shield` facade) in any controller:

```
use XaniaShield\Laravel\ShieldClient;

public function submit(Request $request, ShieldClient $shield)
{
    $verdict = $shield->checkRequest($request, [
        'email'           => $request->input('email'),
        'content'         => $request->input('message'),
        'form_identifier' => 'contact',
    ]);

    if ($verdict->isBlocked()) {
        // Silently drop, show an error, whatever fits your form.
        return back()->with('status', 'Message sent.');
    }

    // allow or challenge — proceed normally
}
```

### With the facade

[](#with-the-facade)

```
use XaniaShield\Laravel\Facades\Shield;

$verdict = Shield::checkRequest($request, [
    'email'           => $request->input('email'),
    'form_identifier' => 'newsletter',
]);
```

### The verdict object

[](#the-verdict-object)

```
$verdict->action();        // 'allow' | 'challenge' | 'block'
$verdict->score();         // 0-100
$verdict->isAllowed();     // bool
$verdict->isBlocked();     // bool
$verdict->shouldChallenge(); // bool
$verdict->reasons();       // string[]
$verdict->requestId();     // string|null
$verdict->failedOpen();    // bool — true if the API was unreachable
```

Honeypot
--------

[](#honeypot)

A honeypot is a hidden field that bots fill and humans never touch. Add one to your form:

```

```

The client reads the configured honeypot field automatically (default `website_url`). To use a different field name, pass it explicitly:

```
$verdict = $shield->checkRequest($request, [
    'email'          => $request->input('email'),
    'honeypot_field' => 'my_hp_field',
    'honeypot_value' => $request->input('my_hp_field', ''),
]);
```

Timing signal (optional)
------------------------

[](#timing-signal-optional)

The timing signal measures how long a form took to fill — bots submit near-instantly. It requires `SHIELD_TIMING_SECRET` to be set.

Render a signed timestamp field in your form:

```
{!! app(\XaniaShield\Laravel\ShieldClient::class)->timingField() !!}
```

The client verifies and includes the elapsed time automatically on the next `checkRequest()`.

Fail-open vs fail-closed
------------------------

[](#fail-open-vs-fail-closed)

By default (`SHIELD_FAIL_OPEN=true`), if the API is unreachable, times out, or errors, submissions are **allowed** — protection never breaks your forms. Set `SHIELD_FAIL_OPEN=false` to block on uncertainty instead (stricter, but a Shield outage would block submissions).

Health check
------------

[](#health-check)

```
Shield::configured(); // has an API key + https base URL
Shield::health();     // API reachable and key valid
```

Configuration reference
-----------------------

[](#configuration-reference)

All values are read from `config/shield.php` (env-driven):

KeyEnvDefaultPurpose`api_key``SHIELD_API_KEY``''`Your site API key`base_url``SHIELD_BASE_URL``https://xaniashield.com/v1`API base URL`timeout``SHIELD_TIMEOUT``5`Request timeout (seconds)`fail_open``SHIELD_FAIL_OPEN``true`Allow on API failure`timing_secret``SHIELD_TIMING_SECRET``''`HMAC secret for timing`challenge_threshold``SHIELD_CHALLENGE_THRESHOLD``40`Score for challenge`block_threshold``SHIELD_BLOCK_THRESHOLD``70`Score for block`honeypot_field``SHIELD_HONEYPOT_FIELD``website_url`Honeypot field name`timing_field``SHIELD_TIMING_FIELD``xsh_tf`Timing field nameIntegration recipes
-------------------

[](#integration-recipes)

Forms differ across projects — field names, honeypots, Livewire vs controllers. Pick the entry point that fits. All of them ultimately call the same engine; choose by how much control you want.

### 1. Middleware (simplest — protect a whole route)

[](#1-middleware-simplest--protect-a-whole-route)

For standard forms with `email` / `message` / `name` / `subject` fields:

```
Route::post('/contact', [ContactController::class, 'submit'])
    ->middleware('shield:contact');
```

On a block verdict it aborts with HTTP 422 before reaching your controller. No controller changes needed. For non-standard field names, use one of the options below instead.

### 2. Validation rule (idiomatic — fits existing validation)

[](#2-validation-rule-idiomatic--fits-existing-validation)

```
use XaniaShield\Laravel\Rules\ShieldRule;

$request->validate([
    'email'   => ['required', 'email', new ShieldRule('contact')],
    'message' => ['required', 'string', 'max:5000'],
]);
```

Attach the rule to **one** field only (usually `email`) — it analyses the whole request, not just that field. A block fails validation with a generic message you can customise: `new ShieldRule('contact', 'Your message looks like spam.')`.

### 3. Controller call (most control — custom field mapping)

[](#3-controller-call-most-control--custom-field-mapping)

When your fields are non-standard, map them explicitly:

```
use XaniaShield\Laravel\Facades\Shield;

public function submit(Request $request)
{
    $verdict = Shield::checkRequest($request, [
        'email'           => $request->input('contact_email'),   // custom name
        'content'         => $request->input('enquiry_body'),
        'form_identifier' => 'enquiry',
        'honeypot_field'  => 'company_website',                  // custom honeypot
        'honeypot_value'  => $request->input('company_website', ''),
    ]);

    if ($verdict->isBlocked()) {
        return back()->withErrors(['enquiry_body' => 'Could not send. Please try again.']);
    }

    // proceed
}
```

### 4. Livewire component

[](#4-livewire-component)

```
use XaniaShield\Laravel\ShieldClient;

public function submit(ShieldClient $shield)
{
    $verdict = $shield->analyze([
        'email'           => $this->email,
        'content'         => $this->message,
        'form_identifier' => 'contact',
        'visitor_ip'      => request()->ip(),
    ]);

    if ($verdict->isBlocked()) {
        $this->addError('message', 'Could not send. Please try again.');
        return;
    }

    // proceed
}
```

Livewire has no per-submit HTTP request for the form fields, so pass values from the component state and add `visitor_ip` explicitly.

### 5. Form Request class

[](#5-form-request-class)

```
use Illuminate\Foundation\Http\FormRequest;
use XaniaShield\Laravel\Rules\ShieldRule;

class ContactRequest extends FormRequest
{
    public function rules(): array
    {
        return [
            'email'   => ['required', 'email', new ShieldRule('contact')],
            'message' => ['required', 'string'],
        ];
    }
}
```

### 6. API endpoint (JSON)

[](#6-api-endpoint-json)

```
$verdict = Shield::checkRequest($request, [
    'email'           => $request->input('email'),
    'content'         => $request->input('body'),
    'form_identifier' => 'api-contact',
]);

if ($verdict->isBlocked()) {
    return response()->json(['message' => 'Rejected as spam.'], 422);
}
```

### Honeypot & timing in Blade

[](#honeypot--timing-in-blade)

Add a honeypot (and optionally a timing field) to any form with directives:

```

    @csrf
    @shieldHoneypot
    @shieldTiming   {{-- only renders if SHIELD_TIMING_SECRET is set --}}

    Send

```

`@shieldHoneypot` renders a hidden field named after `config('shield.honeypot_field')`. The client reads it back automatically.

License
-------

[](#license)

MIT — see [LICENSE](LICENSE).

###  Health Score

36

—

LowBetter than 79% of packages

Maintenance90

Actively maintained with recent releases

Popularity1

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity42

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

47d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/90c4a7a7678310967eeef19eca4b660a272c8436522a4a3cae7d12db494d7ccf?d=identicon)[xaniacode](/maintainers/xaniacode)

---

Top Contributors

[![xaniacode](https://avatars.githubusercontent.com/u/305349712?v=4)](https://github.com/xaniacode "xaniacode (1 commits)")

---

Tags

laravelspamHoneypotanti-spamgdprprivacyspam protectionbot-detectionxania-shield

### Embed Badge

![Health badge](/badges/xaniashield-laravel/health.svg)

```
[![Health](https://phpackages.com/badges/xaniashield-laravel/health.svg)](https://phpackages.com/packages/xaniashield-laravel)
```

###  Alternatives

[psalm/plugin-laravel

Psalm plugin for Laravel

3365.5M359](/packages/psalm-plugin-laravel)[laravel/socialite

Laravel wrapper around OAuth 1 & OAuth 2 libraries.

5.7k118.2M1.0k](/packages/laravel-socialite)[laravel/mcp

Rapidly build MCP servers for your Laravel applications.

80732.6M270](/packages/laravel-mcp)[defstudio/telegraph

A laravel facade to interact with Telegram Bots

818355.4k3](/packages/defstudio-telegraph)[api-platform/laravel

API Platform support for Laravel

58190.1k22](/packages/api-platform-laravel)[simplestats-io/laravel-client

Server-side analytics for Laravel that follows the full funnel from visit to registration to payment, attributed to the channel that drove it. Revenue, MRR, churn and ad-spend profit (ROAS/CAC) per channel. GDPR compliant, ad-blocker proof.

5226.7k](/packages/simplestats-io-laravel-client)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)