Filament Hcaptcha Laravel Package

Product Decisions This Supports

• Bot & spam protection on public-facing forms: Enables decisions on whether to gate user registration, login, password reset, contact, and lead-gen forms with a CAPTCHA — a recurring product/security requirement for any Laravel app with an admin or auth surface.
• Build vs. buy for form security: A drop-in Filament plugin means the team can "buy" (adopt) instead of building custom CAPTCHA field rendering, validation wiring, and provider SDK integration — useful input to roadmap cost estimates for auth hardening.
• Admin panel UX decisions: Because the widget lives inside Filament forms, it directly affects decisions about sign-up/onboarding flow friction, accessibility, and localization of the CAPTCHA challenge.
• Compliance & risk posture: Supports decisions around abuse mitigation (credential stuffing, form spam) for products where unauthenticated input is a vector.
• Provider strategy: Forces an explicit choice among reCAPTCHA v2 (supported), v3/Turnstile/hCaptcha (not natively indicated) — a decision point for privacy/GDPR-sensitive products.

When to Consider This Package

Consider adopting when:

• Your product is built on Laravel + Filament and you need CAPTCHA on auth or public forms with minimal custom code.
• You want a small, focused, maintainable plugin rather than coupling CAPTCHA logic into application code.
• reCAPTCHA v2 (checkbox/invisible) is acceptable to stakeholders and privacy/legal review.
• You value a package showing active maintenance — v1.1.2 (a rendering/centering fix) indicates recent, ongoing upkeep, though at a low release velocity.

Look elsewhere when:

• You are not using Filament — a plain Laravel form component or a dedicated validation rule package would be more appropriate.
• You need enterprise-grade bot mitigation (behavioral scoring, adaptive challenges, edge-level filtering) — consider Cloudflare Turnstile, hCaptcha, or a WAF/bot-management layer instead.
• Privacy or accessibility requirements rule out Google reCAPTCHA specifically.
• You need multi-provider abstraction or server-side score thresholds (v3) — confirm support before committing.
• The project requires a vetted, high-adoption dependency; a single-maintainer package is a supply-chain/maintenance risk to weigh.

Caveat from this release: the v1.1.2 fix addresses reCAPTCHA v2 rendering and widget centering — meaning earlier versions could render v2 incorrectly in some form layouts. Validate current rendering across your form contexts after upgrading rather than assuming parity.

How to Pitch It (Stakeholders)

For executives: This is a low-cost, low-risk security add-on that protects our registration, login, and intake forms from automated abuse and spam. It plugs into our existing admin framework rather than requiring new tooling or vendor contracts, and the recent patch shows it is still being maintained. Recommendation: adopt on public forms where reCAPTCHA v2 is an acceptable user experience, and revisit if privacy requirements or attack volume escalate.

For engineering: A Filament-native CAPTCHA field that handles widget rendering and validation, removing custom integration work. v1.1.2 is a bug-fix release (fixes reCAPTCHA v2 rendering and centers the widget) with no breaking changes or migrations — safe to bump. Known constraints: it is effectively a reCAPTCHA v2 wrapper, single-maintainer, and does not abstract multiple providers. Plan to confirm layout behavior in each of our forms after upgrade and pin the version for reproducibility.