Statamic Captcha Laravel Package

Product Decisions This Supports

• Form spam defense for Statamic-powered sites: choosing a captcha provider per form without custom code — relevant to marketing/lead-gen forms, contact forms, and public submissions.
• Build vs. buy: replaces the recurring "wire up a captcha driver ourselves" backlog item with a config-driven addon; the real decision reduces to which provider, not whether to build.
• Provider optionality as a product hedge: v1.18.0 adds FCaptcha alongside existing providers, reinforcing a multi-provider abstraction. This supports decisions like switching providers for privacy, cost, or regional compliance (e.g., EU data-residency requirements) without a re-implementation project.
• Compliance/privacy roadmap input: each added provider expands the set of defensible options when legal or security asks that traffic stop going to a given third party.
• Scope signal for internal tooling: the package is a thin, single-purpose integration — useful when deciding whether a small gap is worth absorbing into our own codebase or delegating to an addon.

When to Consider This Package

Adopt when:

• The application is a Statamic site (this is a Statamic addon, not a general Laravel package — there is no drop-in path for plain Laravel form stacks).
• Forms are public-facing and exposed to bot/spam traffic, and the team wants provider choice managed by configuration rather than bespoke code.
• The organisation has or anticipates a preference among captcha vendors (privacy-friendly proof-of-work vs. major cloud vendors), and wants that switchable later.
• Engineering capacity is better spent elsewhere; the marginal value of a hand-rolled integration is low.

Look elsewhere when:

• The app is not Statamic — a native Laravel validation rule or the provider's own SDK is the correct path.
• Requirements demand advanced bot mitigation beyond captcha (rate limiting, WAF, behavioural scoring, server-side risk scoring) — captcha alone is a partial control.
• You need guaranteed long-term maintenance/SLA; single-maintainer community addons carry key-person and deprecation risk worth weighing against vendor-supplied integrations.
• Strict accessibility or no-third-party-script policies apply — captcha solutions generally conflict with these and may need to be designed around.

How to Pitch It (Stakeholders)

For executives: This is a small, focused addon that keeps spam off our public forms without us building or maintaining a custom integration. The newest release simply adds another captcha vendor option, which gives us leverage — we can switch providers for cost, privacy, or compliance reasons without a development project. It is low-cost, configuration-level change, and the main caveat is that it only applies to our Statamic sites and depends on a community maintainer, so it is not a fit for every property.

For engineering: The addon abstracts captcha handling into a provider-based setup inside Statamic forms; v1.18.0 adds an FCaptcha driver (contributed by a new maintainer) with no breaking changes, no deprecations, and no migration work — an additive minor release. Existing configuration continues to work. Recommended action: none required now; evaluate the new provider only if the privacy/regional story is relevant. Flag that it is a single-maintainer dependency and scope it to Statamic properties only.