pecotamic / antispam
Silent server-side timing and content based spam protection for Statamic forms
Maintainers
Package info
Type:statamic-addon
pkg:composer/pecotamic/antispam
Requires
- php: ^8.2
- statamic/cms: ^5.0|^6.0
Requires (Dev)
- mockery/mockery: ^1.6
- orchestra/testbench: ^11.0
- phpunit/phpunit: ^13
README
Silent server-side spam protection for Statamic forms.
The addon places an encrypted timing cookie only on pages containing a Statamic form action under /!/forms/. Submissions without a valid cookie, sent too quickly, or matching configured content patterns are silently discarded through Statamic's FormSubmitted event. Bots receive the regular success response.
Installation
composer require pecotamic/antispam php artisan vendor:publish --tag=pecotamic-antispam-config
Configure protected form handles, timing limits, and optional regular expressions in config/pecotamic/antispam.php. Use * as the form handle to protect every Statamic form.
Static caching
The timing cookie is issued by middleware while the page is rendered. With Statamic's full measure static caching, pages are served straight from disk without booting PHP, so the middleware never runs and the cookie is never set — as a result every submission is rejected as if it had no cookie.
If you use full static caching, exclude the pages containing protected forms from the cache (statamic.static_caching.exclude) so the cookie can be set. The half measure strategy still executes PHP on each request and works without changes.