- What is albertcht/invisible-recaptcha and how does it work in Laravel?
- It is a thin adapter around Google Invisible reCAPTCHA for Laravel: a service provider, facade, Blade and JS renderer, a config stub, and an invisible_captcha validation rule that calls Google's siteverify endpoint. It renders the widget without a visible checkbox and validates submissions server-side with no persistence or schema changes. Because it sits at the HTTP edge, it fits both monoliths and modular Laravel apps cleanly.
- How do I install and configure albertcht/invisible-recaptcha?
- Run composer require albertcht/invisible-recaptcha, publish the config stub, then set RECAPTCHA_SITE_KEY and RECAPTCHA_SECRET_KEY in your .env file. Add the invisible_captcha rule to your FormRequest and render the widget in the Blade form. A standard Laravel form takes roughly half a day the first time and about an hour once your team knows the pattern.
- Does it support Laravel 10, Laravel 11, and PHP 8.3?
- The last release was February 2022, and its illuminate/* constraints cap it around Laravel 9 with no declared PHP 8.2 or 8.3 support. On Laravel 10 or 11 expect to fork the package under your own namespace or override the Composer constraints rather than get a clean install. Spike it on a branch first, and never use --ignore-platform-reqs in production.
- How do I add invisible reCAPTCHA to a form or FormRequest?
- Add the invisible_captcha rule to your FormRequest rules array and render the widget in the Blade form; the package injects the g-recaptcha-response token, which the rule verifies server-side against Google's siteverify endpoint. Publish the config stub and set RECAPTCHA_SITE_KEY and RECAPTCHA_SECRET_KEY in .env. No schema, migrations, or domain changes are needed, which is why it plugs into the natural HTTP-edge seam.
- What happens if Google's siteverify endpoint is unreachable, and can I choose fail-open or fail-closed?
- Verification is synchronous, so every protected submit makes an outbound call to Google, roughly 100 to 400 ms, and is coupled to Google's availability. The package does not document a per-form fail-open or fail-closed switch, so decide the policy deliberately and test both paths. If you need tunable fail modes, wrap the package behind your own CaptchaVerifier interface and handle the decision there.
- How do I test it without hitting Google, and can I fake the HTTP client?
- The package performs the siteverify call through Guzzle, so you can fake or mock the HTTP client in tests and assert on the invisible_captcha rule instead of making real network requests. Contract tests against a faked client are the recommended approach, including a simulated outage case. Wrapping the package behind an internal CaptchaVerifier interface from day one keeps those tests cheap and future swaps trivial.
- Does it work with Lumen, CodeIgniter, or plain PHP?
- The classes are usable standalone in Lumen, CodeIgniter, and native PHP, but auto-discovery, config publishing, and the Blade directive do not apply, so integration effort roughly doubles. Expect to wire the service provider, widget rendering, and validation manually. For Laravel-only apps the setup stays minimal.
- Why am I getting false negatives or token errors on multi-tab and SPA forms?
- Invisible reCAPTCHA tokens are single-use and expire in about two minutes, so multi-tab flows, back-button navigation, and SPA re-renders can produce failures that look like bot traffic. Re-render or reset the widget after each submit and after validation failures. Instrument the siteverify error rate so you can distinguish token lifecycle problems from real abuse.
- What are the alternatives to albertcht/invisible-recaptcha?
- biscolab/laravel-recaptcha is materially more actively maintained and supports v3, while google/recaptcha is a credible lower-level option worth benchmarking against your Laravel version. Google is steering toward reCAPTCHA v3 and Enterprise, and Cloudflare Turnstile is a common exit path. Wrapping this package in an internal interface makes any of those a one-file adapter change rather than a rewrite.
- Is it safe and maintained enough for production use?
- It is a single-maintainer package with no visible security policy, disclosure process, or SLA, so staleness and bus factor are the top risks. Pin the version, keep your lockfile fresh, and monitor the inherited Guzzle and Illuminate transitive dependencies. Store the secret in a vault with a rotation runbook, and document the fail mode plus an exit path before putting it on a high-traffic form.