- How do I install buzz/laravel-h-captcha in Laravel?
- Install the package with Composer using composer require buzz/laravel-h-captcha. Laravel should auto-discover the service provider; then publish the config with php artisan vendor:publish and set your hCaptcha site and secret keys in the environment. Confirm the package Composer constraints match your Laravel and PHP versions before installing. Test on one low-risk form in a non-production environment first.
- Which Laravel and PHP versions does laravel-h-captcha support?
- The provided context does not list exact Laravel and PHP version constraints, so check the package composer.json and README for the supported matrix. Verify auto-discovery, config caching, and validation rule behavior against your target Laravel version. Treat any version mismatch as a blocker before adopting the package.
- How do I configure hCaptcha site and secret keys for Laravel?
- After publishing the package config, set the hCaptcha site key and secret key through environment variables. The site key is used by the frontend widget, while the secret key must remain server-side only and never be exposed to the browser. Decide who owns secret rotation and rebuild your config cache after any key changes.
- How do I render the hCaptcha widget in a Blade form?
- After configuring your keys, include the package Blade widget or hCaptcha script in your form. The package is described as offering ready-made Blade widgets, so follow its documented directive or component. Confirm the hCaptcha script is compatible with your Content Security Policy and check localization and accessibility requirements for your users.
- How do I validate hCaptcha tokens server-side with this package?
- Apply the package validation rule to your FormRequest or inline validator so the token is verified with hCaptcha on the server. This package is a thin Laravel adapter for verification and does not replace rate limiting, a WAF, or abuse monitoring. Test success, failure, timeout, replay, and misconfiguration scenarios before rolling out.
- Does laravel-h-captcha support testing fakes for automated tests?
- The package blurb mentions swapping in test fakes, so confirm the exact fake API in the README. Use fakes in your automated tests to avoid calling hCaptcha and to simulate success and failure responses. Keep separate tests for timeout, outage, and configuration errors.
- Does laravel-h-captcha support invisible, passive, or Enterprise hCaptcha modes?
- The provided context does not confirm support for hCaptcha Enterprise, passive, invisible mode, or score thresholds. Check the package documentation and source before committing if you need those features. The package is primarily described as a server-side verification adapter with a Blade widget.
- What happens if hCaptcha is down or a verification request times out?
- The context flags hCaptcha outage behavior as a decision point but does not specify package defaults. Decide fail-open versus fail-closed for each protected flow and test timeouts, retries, and outages explicitly. Do not assume the package handles retries or circuit breaking for you.
- Is buzz/laravel-h-captcha suitable for API-only or SPA applications?
- It is a weak fit for API-only, SPA, or mobile-first architectures unless your frontend already integrates hCaptcha and you use the package only for backend token verification. For pure APIs, a shared internal CAPTCHA verification service or middleware may be cleaner. The package is best suited to server-rendered Laravel Blade or Livewire forms.
- How does buzz/laravel-h-captcha compare to alternatives and is it actively maintained?
- Alternatives include direct hCaptcha SDK integration, custom verification code, or other Laravel CAPTCHA packages. The package has low adoption signals, including around 21 stars and 0 dependents, plus a future-dated release metadata item that should be validated as a package health concern. Do not migrate working custom hCaptcha code unless this package materially reduces code or maintenance.