Invisible Recaptcha Laravel Package

Product Decisions This Supports

• Abuse-prevention feature scoping. Decides how signup, login, password-reset, guest checkout, contact, and review-submission flows get bot protection without adding a visible checkbox that depresses conversion. The package gives you an invisible challenge plus a Laravel validation rule (invisible_captcha) so the control can be attached per-form rather than platform-wide.
• Build vs. buy for spam defense. Wrapping Google's reCAPTCHA yourself is a few days of JS wiring, server-side verification, error-state handling, and test coverage. This package turns that into an afternoon of configuration, which is the right trade for teams where bot defense is not a differentiator.
• Vendor/approach selection. Forces an explicit choice between Google reCAPTCHA v2 Invisible, reCAPTCHA v3 (score-based), Cloudflare Turnstile, hCaptcha, or Friendly Captcha — a decision with privacy, cost, and UX consequences that should be made deliberately, not by default.
• Friction-vs-fraud tradeoff. Invisible challenges support the product argument that security shouldn't tax legitimate users. Useful when A/B testing conversion impact of visible CAPTCHAs versus invisible or score-based approaches.
• Compliance and data-flow review. reCAPTCHA sends user signals to Google; this package makes that dependency visible in the architecture, triggering the right GDPR/CCPA, cookie-consent, and DPA conversations early rather than post-launch.
• Roadmap sequencing for trust & safety. Helps prioritize: (1) rate limiting and honeypots, (2) CAPTCHA on the highest-abuse surfaces, (3) move to score-based/edge-based solutions as traffic scales.
• Success metrics definition. Establishes baseline spam rate, challenge pass rate, false-positive rate, signup/checkout conversion delta, and support-ticket volume attributable to "I'm not a robot" failures.

When to Consider This Package

Consider it when:

• The stack is Laravel or Lumen (or CodeIgniter / native PHP) and the team wants a drop-in, framework-idiomatic integration rather than hand-rolled middleware.
• The requirement is specifically reCAPTCHA v2 Invisible — you want the badge-based invisible flow, not v3 scoring.
• You need fast time-to-market on a well-understood, low-complexity protection layer for contact forms, newsletter signups, or internal tools.
• Traffic and abuse volume are moderate, and a managed Google service is acceptable from a privacy standpoint.
• You're on a legacy Laravel version the package still supports and have no near-term upgrade pressure.

Look elsewhere when:

• Maintenance risk matters. The last release is February 2022; the Laravel ecosystem moves fast. Verify compatibility with your Laravel and PHP versions before committing — an unmaintained dependency in the request path is a security and upgrade liability.
• You're starting greenfield. Default to reCAPTCHA v3 or Cloudflare Turnstile (free, privacy-friendlier, often lower friction) rather than v2 Invisible.
• Privacy regulation is strict (EU/UK end users, public-sector, healthcare, children's products). Sending behavioral signals to Google needs legal sign-off; a self-hosted or EU-hosted alternative may be mandatory.
• You need active support, security patching, or an SLA — an abandoned OSS package cannot provide it.
• Abuse is sophisticated or high-volume (credential stuffing, scraping, API abuse). CAPTCHA alone is insufficient; pair with rate limiting, device fingerprinting, WAF/bot management, and risk scoring.
• You need accessibility guarantees or full control over challenge UX; the Google badge and challenge flow are not yours to customize.

How to Pitch It (Stakeholders)

To executives: This is a small, MIT-licensed, ~600-star open-source integration that lets us add invisible bot protection to our forms in days instead of weeks, with no license cost and no visible checkbox to hurt conversion. It addresses a real abuse vector on signup and checkout. The caveat is maintenance: the package hasn't shipped since early 2022, so I recommend a time-boxed spike to confirm compatibility, a documented fallback (reCAPTCHA v3 or Cloudflare Turnstile), and treating it as an interim control rather than a five-year foundation. Expected investment is low single-digit engineer-days; the risk is contained and reversible.

To engineering: It's a thin Laravel wrapper around reCAPTCHA v2 Invisible — Blade directive for the badge, a validation rule, and server-side verification. Low integration cost, but you inherit an unmaintained dependency in the request path. Please confirm PHP/Laravel version support, review the Google data flow, and instrument challenge failures so we can measure false positives. If compatibility is shaky, we standardize on Turnstile instead and keep the same product behavior.

Decision requested: Approve a short evaluation spike and a go/no-go on this package versus a maintained alternative, with the abuse-mitigation outcome — not the library — as the success criterion.