Download the PHP package tmi/anti-spam without Composer
On this page you can find all versions of the php package tmi/anti-spam. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download tmi/anti-spam
More information about tmi/anti-spam
Files in tmi/anti-spam
Package anti-spam
Short Description Framework-light, presentation-free anti-spam primitives for Symfony forms: honeypot + timestamp + JS-token detection and a reusable form-type extension.
License MIT
Homepage https://github.com/CreativeNative/anti-spam
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package anti-spam
tmi/anti-spam
Framework-light, presentation-free anti-spam primitives for Symfony forms.
Layer 1 — honeypot stack (free, no CAPTCHA, no third party). Three cheap, JS-and-bot-resistant signals:
- Honeypot — a hidden
websitefield a human never fills. - Timestamp —
_loaded_at(unix seconds, set by JS on page load). Submissions faster than 3 s or older than 6 h are rejected. - JS token —
_js_token, set by JS on first user interaction to the form's expected constant. A missing/mismatched token means JS never ran (bot).
Layer 2 — Cloudflare Turnstile (optional, stronger). A decoupled siteverify
wrapper with an injected hostname allow-list — catches what the honeypot can't and
vice versa. Use both for defence-in-depth.
Carries no entities, templates, translations or routes — pure logic + one form-type extension + one Stimulus controller. Detachable by design.
Install
Register the bundle (Symfony Flex does this automatically):
Usage
1. Add the honeypot fields to a form
2. Wire the JS (Stimulus)
Copy assets/controllers/antispam_controller.js into your app's
assets/controllers/ (or register the package's UX assets).
3. Check on submit
Pair it with a Symfony rate_limiter on the submit endpoint for layered defence.
4. (Optional) Cloudflare Turnstile
TurnstileVerifier is app-decoupled — it takes the allowed hostnames as a
constructor argument rather than reading any app host registry, so subclass it (or
wire it) to supply your own list. The HTTP client should be a scoped client
pointed at https://challenges.cloudflare.com; the secret stays server-side.
Hostnames are normalized (lowercase + trailing .local strip for dev parity)
before comparison. The widget JS + sitekey stay in your app.
License
MIT.
All versions of anti-spam with dependencies
psr/log Version ^3.0
symfony/config Version ^7.3 || ^8.0
symfony/dependency-injection Version ^7.3 || ^8.0
symfony/form Version ^7.3 || ^8.0
symfony/http-client Version ^7.3 || ^8.0
symfony/http-client-contracts Version ^3.0
symfony/http-kernel Version ^7.3 || ^8.0
symfony/options-resolver Version ^7.3 || ^8.0
symfony/uid Version ^7.3 || ^8.0