Download the PHP package jkphl/antibot without Composer

On this page you can find all versions of the php package jkphl/antibot. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of jkphl/antibot

Informations about the package antibot

jkphl/antibot

Death to spambots! CAPTCHA-less form validation

Antibot decides on the server whether a form submission came from a person or a machine. It never asks the visitor to prove anything: no puzzle, no image grid, no "click all the traffic lights", no proof-of-work in the background.

That is not a convenience — it is the point. Every challenge-response scheme moves the cost of the operator's spam problem onto the people the form is meant to serve, and none of them is fully accessible. Antibot keeps that cost where it belongs. Whatever the heuristics let through is a debt for the site operator to carry, not the visitor.

Development happens at code.tollwerk.net/joschi-kuphal/antibot. The GitHub repository is a mirror kept in step automatically — it is the public face and the source Packagist reads, but pull requests and issues opened against it may be answered from the other side.

How it works

Two ideas carry the whole library, and neither of them stores anything on the server.

The names of the protective fields are unguessable. Every Antibot instance derives a signature from the session, the form, an optional installation secret and the exact validator configuration:

All hidden fields live under that prefix. An armor scraped from one form is therefore worthless in another session, in another form, or after the configuration has changed — the submitted parameters are simply not found, and the submission counts as unvalidated rather than valid.

The time is carried inside a signed token. The HMAC covers the moment the form was served, so a submission that arrives too fast, too late, or with a doctored timestamp is refused without the server having remembered anything about it.

Around those two, a chain of validators inspects the request in a fixed order — trusted addresses first, so that nothing later can overrule them:

Position Validator What it looks at
0 IpWhitelistValidator Addresses that are always let through
10 IpBlacklistValidator Addresses that are never let through
15 BanValidator A subject (address or field value) that is currently banned
20 ParameterBlacklistValidator A single field value against a lookup pool
30 DuplicateValidator Content that has been submitted before
40 ParameterSetValidator Whether the submitted field names match the ones handed out
50 HoneypotValidator Fields no browser fills in
60 ParameterPlausibilityValidator Word and character counts per field
61 ParameterLinkValidator The number of hyperlinks in a field
62 ParameterEqualityValidator The same value repeated across unrelated fields
100 HmacValidator Timing, request method order and the signed token

Installation

Requires PHP 7.4 or later. It has no runtime dependencies beyond two PSR interfaces.

Usage

isValid() is deliberately false for a submission Antibot never saw: a request without any armor is skipped, not passed.

Please find the full documentation in the doc directory.

Dependencies

What an application takes on by requiring this library — direct runtime dependencies, no development tools. The graph is generated from composer.json by composer depgraph, and the pipeline refuses any commit in which it has gone stale.

Quality

The same three run in the pipeline, against PHP 7.4. The code sniffer and the mess detector are configured to be met, not argued with: their findings are fixed, never excluded.

Contributing

Found a bug or have a feature request? Please see contributing and conduct for details.

Security

If you discover any security related issues, please email [email protected] instead of using the issue tracker.

Credits

License

Copyright © 2026 Joschi Kuphal / [email protected]. Licensed under the terms of the MIT license.

All versions of antibot with dependencies

PHP Build Version
Package Version
Requires php Version ^7.4 || ^8.0
psr/http-message Version ^1.1 || ^2.0
psr/log Version ^1.1 || ^2.0 || ^3.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package jkphl/antibot contains the following files

Loading the files please wait ...