README

Time-based spam protection for Contao forms. Adds a minimum delay between page load and form submission using HMAC-signed timestamps.

How it works

1. When the form is rendered, the bundle injects a hidden field containing a UNIX timestamp and an HMAC-SHA256 signature (signed with the application's kernel secret).
2. On submission, the server verifies the signature and checks whether the configured minimum delay has elapsed.
3. If the form was submitted too quickly, an error message is shown and the form is not processed (no email sent, no data stored).

This approach is completely session-independent — it works reliably with HTTP caching, AJAX forms and without session cookies.

Requirements

• Contao 5.0+
• PHP 8.1+

Installation

Via Composer (recommended)

composer require fischerdigital/contao-form-delay-protection-bundle

Manual installation

Clone or download this repository into your vendor/fischerdigital/contao-form-delay-protection-bundle directory and add a path repository to your composer.json:

"repositories": [
    {
        "type": "path",
        "url": "vendor/tbo/contao-form-delay-protection-bundle",
        "options": { "relative": true, "symlink": true }
    }
]

Then run:

composer install

Configuration

1. Open the Contao backend and navigate to Forms.
2. Edit the form you want to protect.
3. In the Form configuration legend, enable Enable time-based spam protection.
4. Select the Minimum time (3, 5, 10 or 15 seconds).

That's it — no JavaScript, no additional configuration.

How the token works

The hidden field value format is timestamp.hmac:

• timestamp: UNIX timestamp (seconds) at render time
• hmac: HMAC-SHA256 over timestamp|formId, signed with %kernel.secret%

The HMAC prevents bots from submitting arbitrary timestamps. The signature can only be generated by the server, making it tamper-proof.

Security

• The HMAC is signed with the application's kernel.secret — the same secret used for CSRF tokens and session signing.
• The token is regenerated on every page load (including AJAX re-renders after failed submissions).
• The signature binds the timestamp to the specific form ID, preventing token reuse across forms.

Compatibility

This bundle works alongside other spam protection methods:

• Contao's built-in security question and honeypot
• ALTCHA (antispam widget)
• Any other form validation

License

MIT