Download the PHP package spatie/laravel-honeypot without Composer

On this page you can find all versions of the php package spatie/laravel-honeypot. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Informations about the package laravel-honeypot

Preventing spam submitted through forms

Latest Version on Packagist Test Status Code Style Status Total Downloads

When adding a form to a public site, there's a risk that spam bots will try to submit it with fake values. Luckily, the majority of these bots are pretty dumb. You can thwart most of them by adding an invisible field to your form that should never contain a value when submitted. Such a field is called a honeypot. These spam bots will just fill all fields, including the honeypot.

When a submission comes in with a filled honeypot field, this package will discard that request. On top of that this package also checks how long it took to submit the form. This is done using a timestamp in another invisible field. If the form was submitted in a ridiculously short time, the anti spam will also be triggered.

After installing this package, all you need to do is to add the x-honeypot Blade component to your form.

The package also supports manually passing the necessary values to your view layer, so you can easily add honeypot fields to your Inertia powered app.

Support us

We invest a lot of resources into creating best in class open source packages. You can support us by buying one of our paid products.

We highly appreciate you sending us a postcard from your hometown, mentioning which of our package(s) you are using. You'll find our address on our contact page. We publish all received postcards on our virtual postcard wall.

Video tutorial

In this video, which is part of the Mailcoach video course, you can see how the package can be installed and used.

Installation

You can install the package via composer:

Optionally, you can publish the config file of the package.

This is the content of the config file that will be published at config/honeypot.php:

Usage

First, you must add the x-honeypot Blade component to any form you wish to protect.

Alternatively, you can use the @honeypot Blade directive:

Using either the Blade component or directive will add two fields: my_name and valid_from_timestamp (you can change the names in the config file).

Next, you must use the Spatie\Honeypot\ProtectAgainstSpam middleware in the route that handles the form submission. This middleware will intercept any request that submits a non empty value for the key named my_name. It will also intercept the request if it is submitted faster than the encrypted timestamp that the package generated in valid_from_timestamp.

If you want to integrate the Spatie\Honeypot\ProtectAgainstSpam middleware with Laravel's built in authentication routes, wrap the Auth::routes(); declaration with the appropriate middleware group (make sure to add the @honeypot directive to the authentication forms).

If your app has a lot of forms handled by many different controllers, you could opt to register it as global middleware.

Usage in Inertia

When using Inertia you must manually pass the values used in the honeypot fields. Here's an example:

Your front-end will get an honeypot object with these keys: enabled, nameFieldName, validFromFieldName, encryptedValidFrom.

Here's an example how these values could be rendered using Vue:

And then in your Vue component, add these values to your form data:

Usage in Livewire

You can use this package to prevent spam submission to forms powered by Livewire.

First, add the UsesSpamProtection trait to your Livewire component:

Next, declare a HoneypotData property and call protectAgainstSpam() in the method that handles form submissions:

Finally, use the x-honeypot in your Livewire Blade component:

Usage in Volt functional syntax

To use this package in Volt functional syntax, return the HoneypotData property from the guessHoneypotDataProperty method.

Disabling in testing

By default, any protected form that is submitted in faster than 1 second will be marked as spammy. When running end to end tests, which should run as fast as possible, you probably don't want this.

To disable all honeypots in code, you can set the enabled config value to false.

Customizing the response

When a spammy submission is detected, the package will show a blank page by default. You can customize this behaviour by writing your own SpamResponse and specifying its fully qualified class name in the respond_to_spam_with key of the honeypot config file.

A valid SpamResponse is any class that implements the Spatie\Honeypot\SpamResponder\SpamResponder interface. This is what that interface looks like:

Even though a spam responder's primary purpose is to respond to spammy requests, you could do other stuff there as well. You could for instance use the properties on $request to determine the source of the spam (maybe all requests come from the same IP) and put some logic to block that source altogether.

If the package wrongly determined that the request is spammy, you can generate the default response by passing the $request to the $next closure, like you would in a middleware.

Customizing the generated honeypot fields

To customize output generated, you can publish the honeypot view with:

The view will be placed in resources/views/vendor/honeypot/honeypotFormFields.blade.php. This is the default content:

Events fired

Whenever spam is detected, the Spatie\Honeypot\Events\SpamDetectedEvent event is fired. It has the $request as a public property.

Testing

Changelog

Please see CHANGELOG for more information on what has changed recently.

Alternatives

If you need stronger spam protection, consider using Google ReCaptcha or Akismet.

Contributing

Please see CONTRIBUTING for details.

Security

If you've found a bug regarding security please mail [email protected] instead of using the issue tracker.

Credits

This package was inspired by the Honeypot package by Maksim Surguy.

License

The MIT License (MIT). Please see License File for more information.


All versions of laravel-honeypot with dependencies

PHP Build Version
Package Version
Requires php Version ^8.0
illuminate/contracts Version ^8.0|^9.0|^10.0|^11.0
illuminate/encryption Version ^8.0|^9.0|^10.0|^11.0
illuminate/http Version ^8.0|^9.0|^10.0|^11.0
illuminate/support Version ^8.0|^9.0|^10.0|^11.0
illuminate/validation Version ^8.0|^9.0|^10.0|^11.0
nesbot/carbon Version ^2.0|^3.0
spatie/laravel-package-tools Version ^1.9
symfony/http-foundation Version ^5.1.2|^6.0|^7.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package spatie/laravel-honeypot contains the following files

Loading the files please wait ....