- How do I install Captchavel in a Laravel application?
- Install it with composer require darkghosthunter/captchavel, then publish the package config and add your site key and secret key. Because the package targets Laravel's native idioms, the service provider is auto-discovered and no manual registration is needed. In your form you drop in the Blade directive, and in your controller you add the captcha validation rule to the request. One caveat: the v7.0.3 release notes state the package is superseded by Laragear/ReCaptcha, so confirm lifecycle status before committing to a new install.
- Which reCAPTCHA modes does Captchavel support?
- Captchavel wraps Google reCAPTCHA across v2 checkbox, v2 invisible, and v3 score-based modes, with server-side verification handled through a facade. The client-side token is generated by the widget or script you render in the form, and the package handles the verification call against Google's siteverify endpoint. If you need v3, plan for score threshold tuning, since low scores fail silently rather than showing an obvious challenge.
- Does Captchavel work with hCaptcha or only Google reCAPTCHA?
- The package presents itself as a single unified API across reCAPTCHA, hCaptcha, and other CAPTCHA providers, so you are not hard-wired to Google at the API layer. The documented and most exercised path is Google reCAPTCHA, including v2 checkbox, v2 invisible, and v3 score-based verification. If hCaptcha support is a hard requirement, verify the specific provider adapter and mode coverage against the source before you rely on it in production.
- Is Captchavel still maintained, and should I use it for a new Laravel project?
- The v7.0.3 release notes state that Captchavel is superseded by Laragear/ReCaptcha, which is described as functionally similar with additional features and performance optimizations. That release contains no security fix, no breaking API change, and no feature content, so it is effectively a redirect notice. For new projects the default answer is to start on the successor package unless a specific blocker prevents it. If Captchavel is already in production, treat migration as planned technical debt with an owner and a target date.
- Which Laravel and PHP versions does Captchavel support?
- The package documentation supplied here does not publish a version compatibility matrix, so check the composer.json constraints and the release history for the exact Laravel and PHP versions you run. The more important consideration is sustainment: the maintainer has redirected users to a successor package, which historically means no further PHP or Laravel major-version compatibility work. Confirm support for any LTS versions still in flight before you build on it.
- How do I test forms protected by Captchavel without calling Google?
- Captchavel ships fakeable testing helpers so you can stub the verification call and keep your test suite fast and offline. Use the fake in your feature tests so form submissions pass validation without any outbound HTTPS request to Google. If you later migrate to the successor package, review these tests: existing suites that stub captcha verification are exactly the ones that need to survive the swap.
- What happens if Google's siteverify endpoint is unreachable or slow?
- Every protected form makes a synchronous outbound HTTPS call to Google's siteverify endpoint inline in the request lifecycle, with no local fallback and no queue. If that call times out or fails, the typical result is a validation failure surfaced to the end user, which is effectively fail-closed behavior. Before rollout, decide explicitly whether you want fail-open with review flagging or fail-closed blocking. Also account for the added latency on the request path.
- Does Captchavel work for SPAs, mobile clients, or API-only Laravel applications?
- Captchavel is built for Laravel's conventional server-rendered request and response flow, using Blade directives, config publishing, and a validator extension. In an SPA, mobile app, or API-only architecture, client-side token generation and injection must be hand-rolled, and you mainly get the server-side verification half of the package. That is workable but considerably less value, so weigh it against a purpose-built or successor option.
- What is the migration path from Captchavel to Laragear/ReCaptcha?
- The maintainer identifies Laragear/ReCaptcha as the successor, describing it as functionally similar with additional features and performance optimizations. The migration itself is small in surface area: config keys, the Blade directive, the validation rule, and the facade call are the touch points to audit. Before you commit, confirm the successor supports the modes you actually use, v2 checkbox, v2 invisible, or v3 score-based, and that it covers your current Laravel and PHP versions. Then verify your stubbed captcha tests still pass against the new package.
- Are there privacy or compliance concerns with using Captchavel in production?
- Captchavel verifies tokens against Google's siteverify service, which means end-user IP addresses and interaction signals leave your infrastructure and go to Google under Google's own terms. For EU and UK traffic this raises data residency and consent questions that should go through Legal and Privacy review before rollout. You should also document the decision on failure behavior when Google is unreachable, and consider the accessibility and conversion impact of challenge-based captchas.