- How do I install biscolab/laravel-recaptcha in a Laravel application?
- Install it with composer require biscolab/laravel-recaptcha, then publish the config file with php artisan vendor:publish for the recaptcha config tag. Set RECAPTCHA_SITE_KEY and RECAPTCHA_SECRET_KEY in your .env file. The package auto-discovers its service provider and facade, so no manual registration is needed on modern Laravel versions. A first protected form usually takes under a day to wire up.
- Does biscolab/laravel-recaptcha support reCAPTCHA v3 as well as v2?
- Yes. The package covers both v2 (checkbox and invisible variants) and v3 score-based verification. You select the version through the published config/recaptcha.php settings rather than through separate packages. For v3 you also supply an action name and a score threshold, since enforcement is probabilistic rather than a simple pass or fail.
- How do I use the reCAPTCHA validation rule in a Laravel FormRequest?
- Add the package's rule to the rules array of your FormRequest, for example 'g-recaptcha-response' => 'required|recaptcha', and it will verify the token against Google's siteverify endpoint during validation. This keeps captcha enforcement alongside your other input constraints instead of scattering bespoke controller logic. The same rule works with $request->validate() in controllers. Remember to request a fresh token on the client for each submission, because tokens are single use.
- Which Laravel and PHP versions does biscolab/laravel-recaptcha support?
- Support depends on the constraint set in the last published release, so inspect the composer.json of the tag you intend to install before committing. Because the repository is archived, there is no guarantee of Laravel 11 or 12 support or PHP 8.3 and 8.4 compatibility work upstream. Validate the constraints against your target framework major, since archived packages are where illuminate/support and guzzlehttp/guzzle conflicts tend to surface.
- Is biscolab/laravel-recaptcha still actively maintained?
- The repository is archived, which means no upstream security patches, no new feature work, and no guaranteed compatibility updates for future Laravel releases. Treat it as an internally owned dependency: fork it into your own namespace or pin a specific commit through a VCS or path repository so patch availability does not depend on Packagist. Assign clear ownership and budget for maintaining the fork's composer.json across each Laravel upgrade cycle.
- How do I configure the reCAPTCHA site key and secret key with environment variables?
- Publish config/recaptcha.php and confirm the key names match the version you actually installed, because the config schema has changed across majors. Then set RECAPTCHA_SITE_KEY and RECAPTCHA_SECRET_KEY in .env and reference them from the config file so the configuration stays cache compatible. Never commit the secret key, and run php artisan config:cache after changes in deployed environments.
- How do I render the reCAPTCHA widget in a Blade form?
- Use the package's Blade directive or facade helper to inject the client-side script and render the widget inside your form. For v2 you get the visible checkbox or invisible variant; for v3 you attach the token to a hidden field via JavaScript before submission. The server-side validation rule is what actually enforces verification, so the rendered widget alone is not protection.
- How do I test reCAPTCHA protected forms in Laravel feature tests?
- Do not let the validation rule leak directly into application code if you want testable forms; define a small internal contract such as CaptchaVerifier::verify(string $token, ?string $action) and bind the package behind it. In tests you can then swap in a fake implementation and assert your form behavior without any outbound HTTP calls. This also avoids slow, flaky tests that depend on Google's availability and removes the need for real keys in CI.
- What happens if Google's siteverify endpoint is unreachable during a form submission?
- Every protected submission makes a synchronous outbound HTTPS call to Google, roughly 100 to 300 ms at p50 and worse across regions, so Google's availability effectively becomes your form availability. The package is a thin adapter over that endpoint and does not provide sophisticated retry or circuit-breaker behavior. Decide deliberately whether to fail open or fail closed, wrap the verification behind your own contract, and add timeouts and logging so an outage degrades predictably instead of silently.
- What are the alternatives to biscolab/laravel-recaptcha for spam protection?
- Cloudflare Turnstile and hCaptcha are the most common swaps, and reCAPTCHA Enterprise is Google's own successor path as v2 and v3 keys are increasingly positioned as legacy. Because direct facade and rule usage across many forms makes a later provider change a cross-cutting refactor, introduce an internal abstraction now and expose your own validation rule that delegates to it. Also confirm the legal position on sending user signals to Google in GDPR jurisdictions before standardizing on reCAPTCHA.