Filament Turnstile Laravel Package

Product Decisions This Supports

• Bot and credential-stuffing mitigation on Filament surfaces — the plugin drops a Turnstile::make('captcha') component into any Filament form, including the panel login page, which is the highest-value target (admin login brute force, session enumeration). This directly supports a security hardening roadmap item that would otherwise be scoped as custom middleware plus a Blade partial.
• Spam suppression on public-facing forms — registration, contact, support, and lead-capture forms built in Filament can ship with a low-friction challenge instead of an internal rate-limiting project or a full WAF rollout.
• Build vs. buy: buy (with a small blast radius) — Cloudflare Turnstile is the vendor; the package is a ~thin adapter over coderflex/laravel-turnstile. This is a "buy the integration, own the config" decision: you get Cloudflare's managed challenge model (no user puzzles, no user tracking model like reCAPTCHA) for the cost of a Composer dependency and two env vars.
• Accessibility and conversion trade-off — non-interactive challenges avoid the classic reCAPTCHA pain point of image puzzles failing for users and for privacy/accessibility reviews. This is a defensible answer to "why not reCAPTCHA" in a design or compliance review.
• UX correctness as a product requirement, not a nice-to-have — the reset-captcha event plus throwFailureValidationException() / onValidationError() hooks solve the real failure mode: a user fails login validation, the token is consumed, and every subsequent attempt fails for reasons that look like a broken page. Shipping this correctly changes the support-ticket profile of the feature.
• Framework lifecycle planning — the package publishes version lines pinned to Filament 2/3/4/5 (^1/^2/^3/^4). That gives a clear upgrade path and a concrete line item for any pending Filament major upgrade.
• Roadmap sequencing input — because the integration is a single form component, "captcha on admin login" can be delivered in a sprint; "captcha everywhere plus monitoring" is a quarter-level initiative. It usefully separates a quick security win from a broader bot-management program.

When to Consider This Package

Adopt when:

• The product runs on Filament and the team owns that stack. The entire value is the Filament form component; on a non-Filament or API-only surface it offers nothing.
• You need protection on admin/panel authentication or a small number of Filament forms, and you want it implemented in hours rather than as a bespoke security project.
• You already accept Cloudflare Turnstile as the challenge vendor (or are vendor-neutral and comfortable making Cloudflare a dependency of an auth flow).
• You are on a supported combination — note that the current ^4.0 line requires Filament v5, Laravel 11/12/13, and PHP 8.3/8.4. Teams on older stacks must pin ^3, ^2, or ^1, which means a slower patch path.
• You can test with Cloudflare's dummy site/secret keys, which makes this cheap to validate in CI and staging before enabling in production.

Look elsewhere / mitigate when:

• Dependency risk is unacceptable for an auth-path component. This is the biggest caveat: 33 stars, a single visible maintainer, and zero dependents mean no herd immunity — no third party is validating that a release stays compatible with your stack. For a login page, treat this as code you are willing to own. If your security policy forbids single-maintainer packages on the auth path, implement the Turnstile widget directly against coderflex/laravel-turnstile or Cloudflare's siteverify endpoint and keep the ~50 lines in-house.
• You need guarantees, not a README. There is no published support SLA, security response commitment, or adoption evidence. Budget for pinning the version, reading the diff on every bump, and having an engineer who can patch it.
• You need protection beyond forms. API endpoints, machine-to-machine traffic, and volumetric attacks are out of scope — that is Cloudflare WAF/bot management or application rate limiting. Do not present this package as a security program.
• You cannot take a Cloudflare dependency for data-residency, vendor-procurement, or contractual reasons.
• Latency and third-party availability in the auth path are non-negotiable. Turnstile verification is an outbound call; a Cloudflare incident becomes a login outage. You must decide and document the fail-open vs. fail-closed policy — and that decision belongs to the PM, not the implementer.
• You want first-class i18n/theme control beyond what's shipped. Theme (light/dark/auto), size, and language are configurable and pass through to Cloudflare's client config, which is adequate but not deep.

How to Pitch It (Stakeholders)

For executives — one paragraph: "Admin panel login is our most attractive target for automated credential attacks, and today it is defended only by passwords. This package adds Cloudflare Turnstile — an invisible bot challenge — to Filament's login and form pages in a small, low-cost change. It's MIT-licensed, roughly a wrapper around an existing Laravel integration, and requires two environment variables and one Cloudflare account. Users see no puzzles, so it doesn't cost us conversions the way reCAPTCHA does. The trade-off is honest: the project is small and single-maintainer, so we treat it as code we own, pin the version, and keep the option to inline it if the maintainer steps away. Recommendation: adopt on the admin login now, pilot on public forms, and measure blocked-attempt volume for one quarter before expanding."

For engineering — the shape of the work:

• Scope: one Composer dependency (coderflex/filament-turnstile, version pinned to your Filament line), TURNSTILE_SITE_KEY / TURNSTILE_SECRET_KEY in env, and a Turnstile::make('captcha') component in the target form schema.
• The non-obvious work is the reset path: dispatch reset-captcha from onValidationError() or override throwFailureValidationException() so a failed attempt doesn't burn the token and lock users out on retry. Reviewers should treat a missing reset as a defect, not tech debt.
• Login-page wiring requires subclassing Filament\Pages\Auth\Login and pointing the panel's ->login(Login::class) at it — small, contained, and reversible.
• Verify against Cloudflare's dummy keys in tests and staging; the package ships a Pest/PHPUnit suite and CI matrix across PHP 8.3/8.4 and Laravel 11/12/13.
• Explicit decision to record: fail-open or fail-closed when Cloudflare is unreachable, and whether the admin login is exempted from any maintenance-mode or support-access paths.
• Risk register: single maintainer, zero dependents, no adoption signal. Mitigations — version pin, changelog review on bump, a spike to inline the widget as a fallback, and a note that the dependency sits on the authentication path in the threat model.
• Rollout: admin login first (highest value, smallest surface), then public forms with conversion monitored, then a review of challenge-pass rates and support tickets before expanding further.