Download the PHP package blendbyte/livewire-honeypot without Composer
On this page you can find all versions of the php package blendbyte/livewire-honeypot. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download blendbyte/livewire-honeypot
More information about blendbyte/livewire-honeypot
Files in blendbyte/livewire-honeypot
Package livewire-honeypot
Short Description Honeypot + time-trap spam protection for Livewire 4 forms. No CAPTCHAs, no external requests.
License MIT
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package livewire-honeypot
livewire-honeypot
Spam protection for Livewire and plain Laravel forms, without CAPTCHAs or external requests. Requires PHP 8.5, Laravel 13, and Livewire 4.
- Hidden bait field with a generated name per form, which browsers and password managers leave alone
- Minimum fill time and form expiry, tracked on the server so bots cannot fake them
- Plain forms too:
<x-honeypot />renders a signed token for forms posting to a controller - Silent rejection that answers bots with a fake success
- Optional JavaScript check, events and logging, CSP nonces, and 12 languages
Install
Protect a Livewire form
Add the trait to your component and validate the honeypot before processing the submission:
Add the component inside the form:
Keep the trait on the component, also when you use a Livewire Form object, and call resetHoneypot() after a successful submission. Honeypot errors appear beside the component; style .hp-error to match your form.
Protect a plain form
Outside a Livewire component, the same Blade component renders a signed token for forms posting to a controller:
A rejected submission redirects back with the error shown beside the component. Do not cache pages containing the form, because every render needs a fresh token.
Configuration
The defaults suit most forms: the bait must stay empty, submissions must wait 5 seconds, and forms expire after 1 hour. To change the waiting time or log detections:
See configuration for every option, per-component settings, and custom bait bindings.
Testing
Bypass the honeypot in tests that focus on the rest of your form:
Documentation
- Configuration: all settings, per-component overrides, custom bindings, and generated names.
- Plain HTML forms: JavaScript verification and rendering the fields yourself.
- Advanced options: silent rejection, responders, events and logs, CSP, JS verification, views, and translations.
- Testing: testing your forms and running the package's own suites.
- Upgrading: what to check when upgrading to 2.2.
Honeypots catch simple automation, not every bot. Keep normal validation, CSRF protection, and rate limiting on your forms.
Maintained by Blendbyte
Blendbyte builds cloud infrastructure, web apps, and developer tools.
We've been shipping software to production for 20+ years.
This package runs in our own stack, which is why we keep it maintained.
Issues and PRs get read. Good ones get merged.
