Weave Code
No Captcha Laravel Package
arcanedev/no-captcha
Laravel wrapper for Google reCAPTCHA v2 and v3 that simplifies spam protection. Includes validation rules, Blade directives, helpers, and configurable options so you can secure forms and verify tokens with minimal setup and clean configuration.
arcanedev/no-captcha is a lightweight Laravel package that protects forms from spam without Google reCAPTCHA or hard-to-read image puzzles. Instead, it renders a simple human-friendly question (e.g. "What is 2 + 5?") and validates the answer server-side, keeping bots out while staying accessible to real users.
Features
- Validation rule (
no_captcha) plugs straight into Laravel's validator - Blade directive
@nocaptcharenders the challenge in your form - Multi-language question sets with configurable locale
- Custom questions and session-based answer storage
- No external API calls, images, or user tracking
Frequently asked questions about No Captcha
- How do I install arcanedev/no-captcha in a Laravel application?
- Install it with composer require arcanedev/no-captcha, then publish the package config and add your Google site and secret keys to the .env file. Add the captcha validation rule to your FormRequests and place the Blade directive in the forms you want to protect. The package is a thin Laravel adapter over Google's siteverify endpoint, so no database migrations or queue workers are involved.
- Which Laravel and PHP versions does arcanedev/no-captcha support?
- The last release was on 2022-02-10, which predates Laravel 10, and its illuminate/support constraint likely caps at Laravel 9. On Laravel 10, 11, or 12 you should expect composer update to fail or require constraint overrides. Verify the real supported matrix with composer why-not before committing, and treat Laravel 10+ installation as a fork-first exercise rather than a normal composer require.
- Does arcanedev/no-captcha support reCAPTCHA v3 and score thresholds?
- The package describes itself as a helper for Google's noCAPTCHA with reCAPTCHA v2 and v3 support. For v3 you normally need to send the action name and evaluate the returned score against a threshold, so confirm the exact rule parameters and behavior in the source for the version you install. Because the project is dated, test v3 score handling rather than relying only on the README.
- Can I use arcanedev/no-captcha in an SPA, Inertia, or API-only Laravel app?
- It is a poor fit for API-first, SPA, Inertia, or mobile clients because most of its convenience lives in Blade directives and server-rendered form validation. In those architectures the widget is rendered by a JavaScript SDK and the token is posted to a JSON endpoint you own, so calling Google siteverify directly in a controller or small service class is simpler. The package then reduces to little more than an HTTP call plus a config array.
- How do I validate reCAPTCHA in a Laravel FormRequest with arcanedev/no-captcha?
- Add a rule such as 'g-recaptcha-response' => 'required|captcha' to the FormRequest or inline $request->validate call that handles the form. This lets Laravel's validator trigger the package's siteverify check alongside your other field rules. For reCAPTCHA v3, also confirm whether you need to pass an expected action or score threshold to the rule.
- Does arcanedev/no-captcha work with php artisan config:cache and .env secret keys?
- The package uses a publishable Laravel config file, so the secret key should come from environment variables and be read through config rather than by calling env() at runtime. Make sure the site and secret keys are present when you run php artisan config:cache during deployment, because cached config will not pick up later .env changes. Verify the published config uses config values correctly before relying on it in production.
- Is arcanedev/no-captcha still maintained, and what should I do on Laravel 10 or newer?
- It has a single maintainer, no announced successor, no vendor behind it, and its last release was in February 2022. On Laravel 10 and newer the dependency constraints will likely block installation, so plan to fork, vendor, or reimplement the small wrapper instead of overriding constraints permanently. The blast radius is limited because Google's siteverify API is simple and stable, and the package itself is only a few hundred lines.
- How can I test reCAPTCHA validation in Laravel without calling Google?
- Treat the package as an HTTP client wrapper and avoid real siteverify calls in tests by faking the outgoing request or swapping the NoCaptcha binding with a fake. Then assert that your FormRequest passes or fails based on the mocked verification result. Also test the required and captcha rules together so missing tokens and rejected tokens follow the failure policy you expect.
- Can I choose fail-open or fail-closed behavior when Google siteverify is unavailable?
- The package does not document a per-form fail-open toggle, and its validation rule generally treats a failed or unreachable verification as invalid, which means fail-closed by default. If a specific form must fail open during a Google outage, implement that explicitly in your own rule or service wrapper and log the decision. Confirm the behavior in the package source before relying on it in production.
- What are the alternatives to arcanedev/no-captcha for Laravel forms and GDPR concerns?
- You can call Google's siteverify endpoint directly from a small controller or service class, which removes the stale dependency while keeping reCAPTCHA. Teams concerned about GDPR and Schrems II often evaluate Cloudflare Turnstile or hCaptcha instead of Google reCAPTCHA. If privacy or legal teams have not approved a Google dependency, resolve that before adopting this package.
Weaver
How can I help you explore Laravel packages today?