CodeIgniter 4 Honeypot

Prevent Spam with CodeIgniter 4 Honeypot

Spam is a major issue for online forms, and CodeIgniter 4 provides a built-in Honeypot filter to prevent bot submissions effectively. The Honeypot technique works by adding an invisible field to the form that real users ignore but bots fill in, allowing the system to detect and reject spam submissions.

1. Enable Honeypot in CodeIgniter 4

To activate the Honeypot feature, open the app/Config/Filters.php file and add 'honeypot' to the global filters:

'before' => [
    'honeypot'
]

2. Configure Honeypot Settings

Modify app/Config/Honeypot.php to adjust the field name and visibility:

public $hidden = true;
public $label = 'honeypot_field';
public $template = '<input type="text" name="{name}" value="" style="display:none;">';

3. Add Honeypot to Forms

Insert the Honeypot field in your form using CodeIgniter's built-in function:

<form method="post" action="<?= site_url('submit-form') ?>">
    <?= csrf_field() ?>
    <?= honeypot() ?>

    <label for="name">Name</label>
    <input type="text" name="name" required>

    <button type="submit">Submit</button>
</form>

4. Validate Honeypot in Controller

Check if the honeypot field is filled before processing the form in the controller:

public function submitForm()
{
    if ($this->request->getPost('honeypot_field')) {
        return redirect()->back()->with('error', 'Spam detected!');
    }

    // Process the form submission
}

5. Final Thoughts

The Honeypot technique is a simple yet effective way to prevent spam. For advanced protection, combine it with CSRF protection and Google reCAPTCHA.