Implementing Honeypot spam prevention in Laravel applications

Link to package: https://github.com/msurguy/Honeypot

For the past couple months I have been seeing an increase of spam submissions on some of my websites. Since spam is just a waste of everybody’s time, I had to tackle this problem quickly and prevent spam bots from annoying me. With a vast array of options to prevent spam available, deciding what to use is not easy.

This tweet by Ian Landsman couldn’t have come at more appropriate time  since I needed some anti spam mechanisms that have already been implemented with Laravel previously:

I quickly decided to convert this package so that it would be compatible with Laravel 4 applications and after some trial and error the package was published that same evening on Packagist: https://packagist.org/packages/msurguy/honeypot

After installing this updated package on some of my applications the spam has dropped to zero over the course of a week. Only long term testing will show if this method is effective enough but so far I am extremely happy with the performance of the Honeypot technique.

You can install the package and use it in your Laravel applications in about 3-5 minutes. Link to installation documentation: https://github.com/msurguy/Honeypot

Where can you use this?

You can use this package to prevent spam that could come from forms on your website. Great examples of pages where this package is useful:

  • Contact forms
  • Registration forms
  • Inquiry forms/Quote requests

How does it work?

“Honeypot” method of spam prevention is a simple and effective way to defer some of the spam bots that come to your site. This technique is based on creating an input field that should be left empty by the real users of the application but will most likely be filled out by spam bots. In addition, this package implements a requirement for the user not to submit the form too quickly. If the form is submitted within few seconds from showing it to the user, it is likely a spam submission.

This package creates a hidden DIV with two fields in it, honeypot field (like “my_name”) and a honeytime field – an encrypted timestamp that marks the moment when the page was served to the user. These fields look like this in the HTML:

<div id="my_name_wrap" style="display:none;">
    <input id="my_name" name="my_name" type="text" value="">  
    <input name="my_time" type="hidden" value="eyJpdiI6IkxoeWhKc3prN2puZllEajRwZ3lrc0I5bU42bUFWbzF1NEVVOEhxbG9WcFE9IiwidmFsdWUiOiJxNEtBT0NpYW5lUjJvWXp6VE45a1U0V3dNbk9Jd2RUNW42NFpiQWtTRllRPSIsIm1hYyI6IjAyMWQ0NWI1NTVkYTBjZTAxMTdhZmJmNTY0ZDI4Nzg4NzU3ODU4MjM1Y2MxNTVkYjAwNmFhNzBmNTdlNmJmMjkifQ==">
</div>

When the form containing these inputs, invisible to the user, is submitted to your application, a custom validator that comes with the package checks that the honeypot field is empty and also checks the time it took for the user to fill out the form, honeytime. If the form was filled out too quickly (i.e. less than 5 seconds) or if there was any value put in the honeypot field, this submission is most likely from a spam bot.

Installation:

In your terminal type : composer require msurguy/honeypot and provide “dev-master” as the version of the package. Or open up composer.json and add the following line under “require”:

{
    "require": {
        "msurguy/honeypot": "dev-master"
    }
}

Next, add this line to ‘providers’ section of the app config file in app/config/app.php:

'MsurguyHoneypotHoneypotServiceProvider',

At this point the package is installed and you can use it as follows.

Usage:

Add the hidden DIV containing honeypot fields to your form by inserting Form::honeypot macro like this:

{{ Form::open('contact') }}
    ...
    {{ Form::honeypot('my_name', 'my_time') }}
    ...
{{ Form::close() }}

After adding the honeypot fields in the markup with the specified macro add the validation for the honeypot and honeytime fields of the form:

$rules = array(
    'email'     => "required|email",
    ...
    'my_name'   => 'honeypot',
    'my_time'   => 'required|honeytime:5'
);

$validator = Validator::make(Input::get(), $rules);

Please note that “honeytime” takes a parameter specifying number of seconds it should take for the user to fill out the form. If it takes less time than that the form is considered a spam submission.

That’s it! Enjoy getting less spam in your inbox. If you need stronger spam protection, consider using Akismet or reCaptcha

Credits:

Based on work originally created by Ian Landsman: https://github.com/ianlandsman/Honeypot

License:

This work is MIT licensed by Maksim Surguy.

Liked it? Take a second to support Maks Surguy on Patreon!
Become a patron at Patreon!

You may also like

18 comments

  • I also need to implement a spam protection mechanism to the sites I’m currently maintaining. I was thinking of implementing captcha but I’ve seen this blog post. Very simple technique but I think it will be effective. I’ll try this simple spam protection first and see how it goes. Thanks for sharing Maks! 🙂

  • Maks Surguy March 31, 2014  

    You’re welcome! Let me know if it works for you 🙂 Enjoy!

  • Sheikh Heera April 1, 2014  

    It;s a good idea but nowadays spam bots are able to detect the hidden input which should remain blank by checking the type=”hidden” so it’s better to use css style to hide the input (display:none) instead of using type=”hidden”.

  • lyl0o0o April 2, 2014  

    Actually, it is not a hidden input, but a display none on max mackage…

  • Sheikh Heera April 2, 2014  

    I saw type=”hidden” in the example above didn’t see the package yet.

  • Gabriel Sigouin June 23, 2015  

    Since Form are deprecated with laravel 5, can you give the full html version to implement the my_time section plz?

  • maxsurguy June 24, 2015  

    I believe the new version of Honeypot Package (https://github.com/msurguy/Honeypot) has this figured out…

  • Gabriel Sigouin June 24, 2015  

    Ok, so the value in the html example are not generated each time and will work for all implementation of HoneyPot?

  • maxsurguy June 24, 2015  

    No, you basically have to use this shortcut in Blade to generate the proper HTML fields:

    {{ Honeypot::generate(‘my_name’, ‘my_time’) }}

  • Gabriel Sigouin June 24, 2015  

    Ah ok, thx alot for this info. Good job for this great anti spam protection.

  • maxsurguy June 24, 2015  

    You’re welcome!

  • Gabriel Sigouin July 10, 2015  

    With laravel 5+ use this generator:

    {!! Honeypot::generate(‘my_name’, ‘my_time’) !!}

  • S-tomas August 28, 2015  

    Thank You. In my case, field has been displayed only as plain text, with this solution as HTML element. Solved.

  • Dimitri January 14, 2016  

    Can you let me know where I put the validation rules? There doesn’t seem to be any help with exactly where they go?

  • Dimitri January 14, 2016  

    Hey, I think I managed to get it working. I am using Sentinal with Laravel 5.1. I put the two rules in my RegisterRequest.php. I tested it by upping the time to 60 seconds then filled in the form before that time and it just redirected me back to the register page. Changing it back to 5 then filling out the form allowed me to register.

    I have a question about redirecting if it fails. Can I control where it goes after failing? I was thinking of a fake page which I could monitor with google analytics?

  • Gildas Niyigena January 17, 2016  

    You can define these in the “AppHttpRequestsRequest” class as other Request classes extend this, so no need to be declared theme ever!

  • Dimitri January 17, 2016  

    Thanks for the info. That is great to know!

  • Gildas Niyigena January 18, 2016  

    Or, you better define these rules in corresponding Request class, as it’s the standard way of defining rules. Welcome!

Leave a comment