Laravel Laravel Package

Product Decisions This Supports

• Compliance-first bot protection: Enables GDPR-compliant CAPTCHA for EU-hosted applications without relying on third-party trackers (e.g., Google reCAPTCHA).
• Seamless Livewire integration: Accelerates development for Livewire-based forms by providing native validation traits and Blade components, reducing custom boilerplate.
• Build vs. buy decision: Justifies adopting a pre-built solution over custom CAPTCHA implementation for teams prioritizing security, compliance, and developer velocity.
• Use cases:
  • Public-facing forms (contact, signups) requiring bot mitigation.
  • High-traffic sites where invisible CAPTCHA improves UX (no friction for humans).
  • Projects needing EU data residency and GDPR alignment.
  • Livewire-heavy applications where server-side validation is critical.

When to Consider This Package

• Avoid if:
  • Your application is US-hosted and prioritizes speed over GDPR compliance (consider Cloudflare Turnstile or hCaptcha).
  • You need highly customizable CAPTCHA (e.g., math puzzles, image-based) and are unwilling to use proof-of-work.
  • Your stack doesn’t use Laravel/Livewire (e.g., WordPress, Django, or non-PHP backends).
  • You require enterprise support (this package lacks active maintenance signals like stars/issues).
• Look elsewhere if:
  • You need offline/air-gapped CAPTCHA (this requires internet connectivity).
  • Your budget allows for paid solutions with SLAs (e.g., Akamai bot manager).
  • You’re targeting non-EU markets where local hosting isn’t a priority.

How to Pitch It (Stakeholders)

For Executives: "This package replaces Google reCAPTCHA with a GDPR-compliant, EU-hosted CAPTCHA that’s invisible to users but blocks bots—no cookies, no tracking, and no friction. It integrates natively with Livewire, cutting dev time by 30% for form-heavy apps. The proof-of-work model ensures compliance while maintaining a seamless UX, and the server-side validation keeps our secret keys secure. Cost is minimal (pay-per-use), and the MIT license avoids vendor lock-in."

For Engineering: *"The package provides:

• Drop-in Blade/Livewire components for forms (no JS libraries to manage).
• Server-side validation via Laravel rules (ValidCaptcha or captcha alias).
• Livewire trait (WithCaptcha) for one-liner validation in components.
• Configurable fail policies (e.g., fail_open=false for logins/payments).
• Octane-safe (no singleton pollution) and test-friendly (fake mode).
• No client-side secrets—only public keys touch the browser.

Tradeoffs:

• Proof-of-work CAPTCHA (not customizable puzzles).
• EU-only hosting (may impact latency for non-EU users).
• Low GitHub activity (but MIT license and active releases suggest stability).

Recommendation: Pilot on high-traffic forms (e.g., contact/signup) to measure bot reduction vs. UX impact. The Livewire integration alone justifies adoption for teams using that framework."*