Spam Protection

LaraDashboard includes layered anti-spam protection for user registration, password reset, and public-facing forms (contact forms, support tickets, newsletter signups, and module Livewire forms).

Registration honeypot#

On the Authentication settings tab (/admin/settings?tab=authentication):

Setting	Description	Default
Registration honeypot	Adds a hidden field bots fill but humans ignore	Enabled

When enabled, submissions that fill the honeypot field are silently rejected.

---

reCAPTCHA#

Configure reCAPTCHA on the Security tab (/admin/settings?tab=performance-security) and select which pages require it:

Page	Description
Public Forms	Contact and similar module forms
Support Ticket	CRM ticket submission
Newsletter	Newsletter signup
Reset Password	Password reset request

Provide your Google reCAPTCHA site key and secret in Authentication or Security settings, or via GOOGLE_RECAPTCHA_* environment variables.

In demo mode, reCAPTCHA can be skipped when SKIP_RECAPTCHA_IN_DEMO=true.

---

Public form guards#

Core provides PublicFormGuardService for module and Livewire forms. It combines:

• Honeypot validation — hidden field must stay empty
• Spam text patterns — rejects common spam phrases in message fields
• Email domain checks — blocks known disposable email domains

Module developers merge these rules via:

app(PublicFormGuardService::class)->mergeRules($rules, $spamTextFields);

See registration hook filters in CommonFilterHook for customizing spam name patterns.

---

Best practices#

1. Keep registration honeypot enabled on public sites
2. Enable reCAPTCHA on any form exposed to anonymous visitors
3. Combine with server-side validation — never rely on client checks alone
4. Monitor form submission rates in action logs

---

Related#

• Settings — Authentication
• Social Authentication
• Module Development — use PublicFormGuardService in custom forms