Spam protection#

Three checks, no captcha, no third party.

Honeypot#

A text input a person never sees (moved off-screen, excluded from the tab order and from autofill). A submission that fills it is dropped. Field name: spam.honeypot_field (_fb_website). Per form: Honeypot in Settings.

Time trap#

The rendered form carries an encrypted token with the form id and the time it was rendered. A submission whose token is missing, tampered with, issued for another form, or younger than spam.min_seconds (default 2) is dropped. Per form: Minimum seconds before submit; 0 disables it. Headless clients get a token from the definition endpoint and send it back under protection.token_field.

Rate limit#

submissions.throttle (default 10,1: ten submissions per minute per IP) on the submit route, through Laravel's throttle middleware. null disables it.

What the sender sees#

Dropped submissions get the same success state as real ones, so a bot learns nothing. Packstub\FormBuilder\Events\SpamDetected is dispatched with the reason (honeypot, no_token, too_fast), the raw input and the context, for logging.