Weave Code
Filament Captcha Laravel Package
asignua/filament-captcha
asignua/filament-captcha adds CAPTCHA protection to Filament forms, helping block spam and automated submissions. Integrate a captcha challenge into admin panels and custom forms for a simple bot-prevention layer.
Captcha field for Filament forms and Livewire components: reCAPTCHA v2/v3, Cloudflare Turnstile and hCaptcha with a server-side validation rule.
Frequently asked questions about Filament Captcha
- How do I install asignua/filament-captcha in a Laravel application?
- Install it with Composer using composer require asignua/filament-captcha. After that, publish any package configuration or front-end assets and add the site key and secret key for your chosen provider to your .env file. The README lists the exact publish command and the environment variable names the package expects, so follow that before rendering a field.
- Which CAPTCHA providers does asignua/filament-captcha support?
- The package supports Google reCAPTCHA v2, Google reCAPTCHA v3, Cloudflare Turnstile and hCaptcha. All of them sit behind a single field component and a single server-side validation rule, so you can switch providers without rewriting your form code. You only need credentials for the provider you actually enable.
- Can I add a CAPTCHA to the Filament panel login page?
- Yes. The package is designed for Filament 5 forms and explicitly covers the panel login form as well as regular resource and custom forms. You add the captcha field to the login form schema and the matching validation rule, and the package handles the rest. This is the most common way to stop automated login and credential-stuffing attempts against an admin panel.
- How do I add the CAPTCHA field to a Filament form?
- Add the package's captcha field component to your Filament form schema alongside your other fields. Then attach the package's server-side validation rule to the same field so the token is verified against the provider API on submit. The field renders the widget and the rule performs verification, which means client-side rendering alone is never trusted.
- Which Laravel and Filament versions are required?
- The package targets Filament 5 forms, which means it should be used with a current Laravel release that Filament 5 supports. Always check the composer.json constraints in the repository before installing, since they are the authoritative source for PHP and Laravel versions. If you are still on an older Filament major, verify compatibility first or open an issue.
- What are action checks for reCAPTCHA v3 and Turnstile?
- reCAPTCHA v3 and Turnstile issue tokens that are not tied to a visible checkbox, so the server must confirm the token was generated for the expected action. The package lets you assert that action name during validation, which prevents a token harvested from one page being replayed against another. It is a small configuration step but a meaningful hardening measure.
- Can I use test keys for local development and CI?
- Yes. The package ships with support for provider test keys so you can work locally without solving challenges or hitting live verification endpoints. Test keys are also the practical way to keep automated test suites and CI pipelines deterministic. Remember to use real keys in staging and production and keep the secret out of version control.
- Does it work with plain Livewire components outside Filament?
- Yes. Besides Filament forms and the panel login, the package supports plain Livewire components, so you can protect public-facing forms built with Livewire directly. You use the same field and the same server-side rule, which keeps behaviour consistent across your admin panel and your front end.
- How do I test forms protected by a CAPTCHA in my test suite?
- Use the provider test keys described in the package documentation so validation succeeds without a real challenge being solved. Structure your feature tests to submit the form through Livewire or HTTP and assert on the resulting validation state. Because verification happens server-side in a rule, you can also assert that submissions without a valid token are rejected.
- Why use one package for reCAPTCHA, Turnstile and hCaptcha instead of separate SDKs?
- Using a single field and a single validation rule means your form code and tests do not change when you swap providers or run different providers in different environments. It also avoids pulling in three separate client libraries and three different configuration conventions. If you later need to move off a provider for privacy, latency or pricing reasons, the change is largely configuration rather than a rewrite.
Weaver
How can I help you explore Laravel packages today?