Frequently asked questions

What is darvis/livewire-honeypot?

A Laravel package that stops automated form spam without a CAPTCHA. It adds a hidden bait field that must stay empty and refuses a form submitted within minimum_fill_seconds (5 by default). It works in Livewire components and in plain Blade forms with a controller.

How do I protect a Livewire form from spam without a CAPTCHA?

Run composer require darvis/livewire-honeypot, add the Darvis\LivewireHoneypot\Traits\HasHoneypot trait to the component, place <x-honeypot /> inside the form and call $this->validateHoneypot() in the submit action. Call $this->resetHoneypot() after a successful submit.

Which PHP, Laravel and Livewire versions does darvis/livewire-honeypot support?

PHP 8.2 or higher, Laravel 11, 12 and 13, and Livewire 3 and 4, including single-file and multi-file Livewire 4 components. Composer installs Livewire with the package, also when you only protect plain forms.

Can I use the honeypot in a Laravel form without Livewire?

Yes. Put <x-honeypot /> in a plain Blade form and call HoneypotService::validate($request->all()) in the controller. The start time travels in a token signed with the app key. Use version 1.6.0 or higher; older versions reject every submission in an application that runs Laravel’s ConvertEmptyStringsToNull middleware.

Does it use cookies, JavaScript, an API key or a third-party service?

No. The package is free and MIT licensed, adds no cookies and no scripts, and makes no external requests. All checks run on your own server. It only needs the APP_KEY every Laravel application has.

Why would a honeypot block real visitors?

When the hidden field is named or labelled like “website” or “email”, browser autofill and password managers can fill it in, and the form treats the visitor as a bot. <x-honeypot /> renders a generated name such as referral_3f9a, the label “Leave this field empty” and ignore attributes for password managers.

How can I check whether autofill fills my honeypot field?

Use the free honeypot autofill test. It lets your own browser and password manager fill a form with common bait fields, and checks the HTML of your own form for risky names and labels.

How is it different from spatie/laravel-honeypot?

This package shows the visitor a validation error, where spatie/laravel-honeypot returns a blank page by default, and it keeps the Livewire start time in locked properties. spatie/laravel-honeypot offers a route middleware and documented Inertia support. Both packages dispatch an event when spam is blocked.

Does the honeypot work with a strict Content Security Policy?

Yes. When Laravel has a CSP nonce (Vite::useCspNonce()), or you pass nonce="..." to <x-honeypot />, the field is hidden through a nonced style block instead of an inline style attribute.

What spam does a honeypot not stop, and is it safe to rely on?

It stops bots that fill in every field or submit at once. It does not stop a person typing spam by hand, or a bot that runs a real browser, skips hidden fields and waits. The start time cannot be changed by the client, but a form can be submitted many times, so add rate limiting, and a CAPTCHA such as Cloudflare Turnstile if abuse continues.