chh / stack-honeypot
Sets up a form honeypot for spambots and redirects them to a blank page
Requires
- php: >=5.4.0
- symfony/http-foundation: ~2.1
- symfony/http-kernel: ~2.1
Requires (Dev)
- stack/callable-http-kernel: ~1.0@dev
- symfony/browser-kit: ~2.0
- symfony/css-selector: ~2.0
This package is not auto-updated.
Last update: 2024-11-05 02:18:06 UTC
README
A port of Rack::Honeypot to Stack for PHP.
Install
composer require stack/honey-pot:~1.0
Usage
Wrap your HttpKernelInterface app in an instance of CHH\Stack\Honeypot
or add it to your middleware stack.
With stack/builder:
<?php $options = []; $app = (new Stack\Builder) ->push(CHH\Stack\Honeypot::class, $options) ->resolve($app);
Without the builder:
$app = new Stack\Honeypot($app, $options);
From Rack::Honeypot:
This middleware acts as a spam trap. It inserts, into every outputted <form>
, a text field that a spambot will really want to fill in, but is actually not used by the app. The field is hidden to humans via CSS, and includes a warning label for screenreading software.
In the <body>
:
<form>
<div class='phonetoy'>
<label for='email'>Don't fill in this field</label>
<input type='text' name='email' value=''/>
</div>
[...]
In the <head>
:
<style type='text/css' media='all'>
div.phonetoy {
display:none;
}
</style>
Then, for incoming requests, the middleware will check if the text field has been set to an unexpected value. If it has, that means a spambot has altered the field, and the spambot is booted to a dead end blank page.
There are a few options you can pass to the constructor (or to the Stack Builder):
class_name
is the class assigned to the parent div of the honeypot. Defaults to "phonetoy", an anagram of honeypot.label
is the warning label displayed to those with CSS disabled. Defaults to "Don't fill in this field".input_name
is the name of the form field. Ensure that this is tempting to a spambot if you modify it. Defaults to "email".input_value
is the value of the form field that would only be modified by a spambot. Defaults to blank.always_enabled
(defaults totrue
) set tofalse
if you don't want to insert the trap into all responses returned by your app. Just addX-Honeypot: enabled
to your response headers to enable the trap for this response.
License
See LICENSE.txt.